The Authentication Library 1.0.6

[eluser]rdjs[/eluser]
Thanks for your hard work in creating this auth system.

I had two small problems getting everything set up.

1. When a user tries to logout there is a call to sess_destroy() but I had to change this to destroy(). The problem is not a fault with The Authentication Library but that I made some changes to the way sessions are handled in order to get SWFUpload working with the codeigniter upload class as per this thread
http://ellislab.com/forums/viewthread/97399/

2. When registering a user I got the following errors:

Code:

A PHP Error was encountered

Severity: Warning

Message: fopen() [function.fopen]: php_network_getaddresses: getaddrinfo failed: Name or service not known

Filename: libraries/Auth.php

Line Number: 348
A PHP Error was encountered

Severity: Warning

Message: fopen(http://random.org/strings/?num=1&len=20&digits=on&upperalpha=on&loweralpha=on&unique=on&format=plain&rnd=new) [function.fopen]: failed to open stream: No such file or directory

Filename: libraries/Auth.php

Line Number: 348
A PHP Error was encountered

Severity: Warning

Message: fread(): supplied argument is not a valid stream resource

Filename: libraries/Auth.php

Line Number: 349

This could be caused by some kind of infrastructure or server problem. I am testing this app from work and they have very strict I.T. policies, firewalls etc. It could also be some kind of server setting.

Here is the code from libraries/Auth.php around line 348:

Code:

if (ini_get('allow_url_fopen')) {
          // Grab the random string using the easy version if we can
          $token_source = fopen($rand_url, "r");
          $token = fread($token_source, 20);
        }

My hunch is that the server restrictions and php.ini settings are not aligned. As the code checks the ini to see if it can use fopen(), as it is told there are no problems it gives it a try.

Either way the registration seems to work as expected so I have just suppressed the warnings like so...

Code:

if (ini_get('allow_url_fopen')) {
          // Grab the random string using the easy version if we can
          $token_source = @ fopen($rand_url, "r");
          $token = @ fread($token_source, 20);
        }

Which works OK as $token contains a value like UnUmfDzdu7CQshCYqcD. I wonder however if it would be easier to generate the unique string a more like this:

Code:

$token = sha1(mt_rand(10000,99999).time().$username);

And then the whole if / ifelse / else section in the _genrate() function can be replaced?

Thanks again for your hard work on this great library.