PHP Sessions Issue

Question

Hey Guys,

I am having one hell of a problem that I cannot figure out for the life of me. I have set up a super simple CMS for a client. Each different page of the CMS has and include file called session.php.

session_start(); 
$username = $_SESSION['siteadmin'];
if (!$_SESSION['siteadmin']){
    header( 'Location: login.php?status=2' );
}  

Every now and again, random things would disappear from the database. So, I setup a crude log system that logged any action through the CMS. Well, it happened again. The logs show this:

Logged in                           **.**.237.209   17:18  <-- thats me
Deleted board member id 12  195.42.102.25   16:49 
Deleted board member id 15  195.42.102.25   16:49 
Deleted board member id 8   195.42.102.25   16:49 
Deleted board member id 10  195.42.102.25   16:49 
Deleted board member id 9   195.42.102.25   16:49 
Deleted board member id 4   195.42.102.25   16:49 
Deleted board member id 3   195.42.102.25   16:49 
Deleted board member id 5   195.42.102.25   16:49 
Deleted board member id 6   195.42.102.25   16:49 
Deleted board member id 11  195.42.102.25   16:49 
Deleted board member id 7   195.42.102.25   16:49 
Deleted review id 2             195.42.102.25   16:49 
Deleted review id 3             195.42.102.25   16:49

and that goes on for a couple pages. It doesn't even show 195.42.102.25 logging in! Last time it happened with 195.128.18.19. How are they computers loading the window without a session variable? Is there a security hole in my code that I am completely overlooking?!

Any insight on this issue would be awesome.

Thanks,

Answer 1

Put an exit after header.

Answer 2

Consider adding session_regenerate_id() after the session_start. This will prevent session cookie stealing (PHPSESSID in your cookies' id is regenerated on each pageload if you use the above function), which is probably what is happening (apart from the exit problem on the answer above)

Answer 3

Indeed, put an exit or a die afer the header.

It is quite easy not to follow the header redirection and to get what is executed aferwise.

There is a fun post on The Daily WTF (and more complete) on this issue that I cannot find for the time being.

Edit: Found it! :) http://thedailywtf.com/Articles/WellIntentioned-Destruction.aspx