views:

137

answers:

2

I am using swf-upload to handle file uploads on a site I am working on.

The problem is the catching function, called swf-upload.php. If I visit the URL it is at directly it works fine, it correctly reads starts the session and gets the user rights, but when the web page calls it with the ajax callback it claims the session is empty.

I am using a combination of error handlers and output logging to find out what it's doing and there is utterly no difference in the code path between the direct access and the ajax access.

Any ideas what's up?

+1  A: 

Maybe you could pass session id explicitly via PHPSESSID in your ajax url? You can read it with session_id() function http://pl2.php.net/manual/en/function.session-id.php

Kamil Szot
this is a possible security risk. I wouldn't advise this
Robert Cabri
I don't think that in this specific case this is severe security risk. Especially if you regenerate your session id and don't accept previously unknown session id-s. Anyway, you should read about protecting yourself against session hijacking before applying that solution.
Kamil Szot
+2  A: 

This is a known issue in swfupload, you need to pass your session id in to the swfupload constructor and then recreate explicitly restart this session in your remote file using the session id you have passed like this:

 // in your javascript file 
 swfu = new SWFUpload({
  upload_url: "http://<?=$_SERVER['HTTP_HOST']?>/scripts/swfupload2/upload.php",
  post_params: {"PHPSESSID": "<?=session_id()?>"}
 }

 // in your PHP file
 if (isset($_POST["PHPSESSID"])) {
  session_id($_POST["PHPSESSID"]);
 }
seengee