ft_api_login - permission problem

[Hannes]

I have a client (username/passwort) whom i want to login automatically.
Therefore I'm using the following script:

PHP Code:

<?php
require_once("global/api/api.php");
$account_info = array(
  "username" => "username",
  "password" => "password"
);
ft_api_start_sessions();
ft_api_login($account_info);
header("Location: index.php");
exit;
?>

The client is logged in and the client_form page appears but as soon as I click to view submissions of a form I'm logged out with the error message:

You do not have the permissions to access this page. You have been logged out.

Please advise me what the problem is.

best regards, Hannes

[Ben]

Hi Hannes,

That should work... but try this instead. The ft_api_start_sessions function is really just for API forms.

PHP Code:

<?php
session_start();
header("Cache-control: private");
header("Content-Type: text/html; charset=utf-8");

require_once("global/api/api.php");
$account_info = array(
  "username" => "username",
  "password" => "password"
);
ft_api_login($account_info);

header("Location: index.php");
exit;
?>

Note, index.php will have to have those session_start() lines at the top as well, otherwise sessions will be lost before the user attempts to log in.

All the best -

Ben

[Hannes]

same thing happens:
when I login and logout the conventional way before going to this page it works.
But just running this script I don't have the permission.

[Ben]

Hey Hannes,

That's weird, I tested it out myself and it works okay.

So just to double check: every page that you go to AFTER logging in via the script and BEFORE linking to a Form Tools page has the session_start() stuff on it, correct?

Try this: add a little code to that page (or pages) to confirm that the login information is still in sessions.

PHP Code:

<?php print_r($_SESSION["ft"]); ?>

That should output a whole thwack of information about the user who just logged in. If it doesn't output anything (just "Array( )") then we know that the sessions aren't being stored properly and that's why Form Tools is booting you out.

- Ben

[Hannes]

Hey Ben,

thank you a lot for your efforts.
by the session_start() stuff you mean those lines?

PHP Code:

require("../../global/session_start.php");
session_start();
header("Cache-control: private");
header("Content-Type: text/html; charset=utf-8"); 


I added them to the beginning of /clients/forms/index.php - that is the page where I'm linking to (clients/forms/index.php?form_id=1).
Did you login as administrator the session before? Don't ask me why but that's the only case the script works on my installation - if it's not the case i still get the error message.

---

when printing the session information it shows correctely

Code:

...[account] => Array ( [account_id] => 2 [account_type] => client [account_status] => active [ui_language] => en_us [timezone_offset] => 0 [sessions_timeout] => 30 [date_format] => M jS y, g:i A [login_page] => client_forms [theme] => default [menu_id] => 2 [first_name] => user [last_name] => name [email] => user@name.de [username] => username [password] => 696d29e0940a4957748fe3fc9efd22a3...

after removing the line I still get the permission error.
When logging in the conventional way the client has the permission to view this form...

best regards, Hannes

[Ben]

Ah - first off, I wouldn't modify the core script. That won't be needed at that point anyway - the pages all start with the session_start(), so the following 3 lines you posted are just duplicates.

But no, I actually meant that any pages outside of Form Tools that you're users who login via the form are going to be navigating to before eventually ending up on a Form Tools page need to have those session_start lines.

If you're royally stuck, email me at ben.keen@gmail.com with your FTP info, a link to your api login form and a description of which pages the user will go to prior to going to Form Tools. I could then debug the problem directly.

- Ben

[Hannes]

Hi Ben,

thank you a lot for your effort.
but I still don't get it... there is no external file involved in this:

1. I installed a fresh downloaded version of formtools on my local server (php5).
   
2. I added a client called "username" with password "password".
   
3. I add a form and allow access to all clients.
   
4. I created a file forms/show.php with only the following content:
   
   PHP Code:

   <?php
require("global/session_start.php");
session_start();
header("Cache-control: private");
header("Content-Type: text/html; charset=utf-8");
require_once("global/api/api.php");
$account_info = array(
  "username" => "username",
  "password" => "password"
);
ft_api_login($account_info);
header("Location: clients/forms/index.php?form_id=1");
exit;
?>
5. I logout as administrator and change my client computers IP.
   
6. If I now goto show.php I directly end up in "?message=notify_invalid_permissions"
   

but...

• If I login with the same client using the login-form it shows "clients/forms/index.php?form_id=1" perfectly with all permissions.
  
• If I place "<?php print_r($_SESSION["ft"]); ?>" in "clients/forms/index.php?form_id=1" it shows me the correct user informations when running "show.php"
  
• And the original "clients/forms/index.php" of the current version does definitely have none of those lines you wanted me to add:
  PHP Code:

  session_start();
header("Cache-control: private");
header("Content-Type: text/html; charset=utf-8"); 


Did I miss any step?

best regards, Hannes.

[Ben]

Hi Hannes,

I tried that code and it actually works fine for me. One thing: remove the very first require() line.

PHP Code:

require("global/session_start.php"); 


That's not needed, but it shouldn't cause an error...

You mentioned you created that file at the following location: forms/show.php. Is the /forms folder the Form Tools root folder (i.e. the folder with the main login form for the script?)

If so, that's correct.

Are you running 1.0.0 of the API, btw? If not, download it!
http://docs.formtools.org/api

I must say, I'm kind of stumped on this... it should work - it certainly does on my installation.

- Ben

[Hannes]

Update: I just found this thread again because I needed the autologin feature again and wanted to confirm that it was the first line which is causing the error.

The way Ben wrote it is also working in 2.1:

PHP Code:

<?php
session_start();
header("Cache-control: private");
header("Content-Type: text/html; charset=utf-8");
require_once("global/api/api.php");
$account_info = array(
  "username" => "username",
  "password" => "password"
);
ft_api_login($account_info);
header("Location: clients/forms/index.php?form_id=1");
exit;
?>

whereby "clients/forms/index.php?form_id=1" is the startup-page.