Re: SyncML Session Question

Logan Owen <[email protected]> Mon, 28 Feb 2011 07:50:36 -0500

Newsgroups	gmane.comp.horde.sync
Message-ID	<[email protected]>

All,

I believe I fixed the problem, as I am now able to successfully sync with my
Horde server.

I am attaching a patch for the issue.  Is there a better way to make sure
these changes get made to the main development branch?

Thanks,
Logan

On Sun, Feb 27, 2011 at 8:37 PM, Logan Owen <[email protected]> wrote:

> Hey,
>
> I am using the git HEAD version of Horde, and am having problems using
> SyncML.  My device (an Android using the Funambol client) sends two
> messages.  The first one authorizes itself, but the second one fails as
> being unauthorized.
>
> I believe I have traced the problem to a session problem.  The
> SyncML_State is not being saved and retrieved correctly.  I think the
> problem is because the client does not use regular HTTP sessions
> (storing cookies, etc), but rather holds the session in the body of the
> message.  I believe that this is what is causing the problem.  I get
> stuck trying to trace how sessions are handled internally in Horde.
> Additionally, the session is being rekeyed by checkAuthorization() when
> it calls Horde_Core_Factory_Auth->authenticate().
>
> Any guidance in the correct way to override SESSION ->setup() so that it
> associates multiple client requests with the same SessionId to the same
> Horde_Session would be greatly appreciated.
>
> Thanks,
> Logan
>
>
>

-- 
sync mailing list - Join the hunt: http://horde.org/bounties/#sync
Frequently Asked Questions: http://horde.org/faq/
To unsubscribe, mail: [email protected]

0001-Update-SyncML-to-enable-syncing-with-at-least-the-An.patch (application/octet-stream, 2.9 KB)

From 51af683b17cb45efe685abf524bcde707c15a717 Mon Sep 17 00:00:00 2001
From: Logan Owen <[email protected]>
Date: Mon, 28 Feb 2011 07:31:24 -0500
Subject: [PATCH] Update SyncML to enable syncing with at least the Android Funambol Client

---
 framework/SyncML/SyncML/Backend/Horde.php |   38 ++++++++++++++++++++++------
 1 files changed, 30 insertions(+), 8 deletions(-)

diff --git a/framework/SyncML/SyncML/Backend/Horde.php b/framework/SyncML/SyncML/Backend/Horde.php
index 92f6d3c..868b7eb 100644
--- a/framework/SyncML/SyncML/Backend/Horde.php
+++ b/framework/SyncML/SyncML/Backend/Horde.php
@@ -66,19 +66,33 @@ class SyncML_Backend_Horde extends SyncML_Backend {
         /* Only the server needs to start a session. */
         if ($this->_backendMode == SYNCML_BACKENDMODE_SERVER) {
             /* Reload the Horde SessionHandler if necessary. */
-            $GLOBALS['session']->setup(false);
+            /* SyncML carries the session information in the message.*
+	     * This is neccessary to force PHP to associate multiple
+	     * requests with the same session.
+	     */
+
+            $sid = md5($syncDeviceID . $sessionId);
+            session_id($sid);
+            $GLOBALS['session']->setup();
             $this->state = $GLOBALS['session']->get('horde', 'syncml');
-            register_shutdown_function(array($this, 'sessionShutdown'));
         }
     }
 
-    function sessionShutdown()
+    /**
+     * Cleanup function called after all message processing is finished.
+     *
+     * Allows for things like closing databases or flushing logs.  When
+     * running in test mode, tearDown() must be called rather than close.
+     */
+    function close()
     {
-        if ($this->state) {
-            $GLOBALS['session']->set('horde', 'syncml', $this->state);
-        }
-    }
+	if ($this->state) {
+	  $GLOBALS['session']->set('horde', 'syncml', $this->state);
+	}
 
+	parent::__close();
+    }
+    
     /**
      * Returns entries that have been modified in the server database.
      *
@@ -469,10 +483,18 @@ class SyncML_Backend_Horde extends SyncML_Backend {
      */
     function _checkAuthentication($username, $password)
     {
+        /* $auth->authenticate() calls a method which regenerates the session_id
+	 * to prevent session fixation.  Usually, this is a good idea, but because
+	 * the server can't change the SyncML session ID, we need to force the
+	 * session id back to the old value.
+	 */
+        $sid = session_id();
         $auth = $GLOBALS['injector']->getInstance('Horde_Core_Factory_Auth')->create();
-        return $auth->authenticate($username, array('password' => $password))
+        $auth_val = $auth->authenticate($username, array('password' => $password))
             ? $GLOBALS['registry']->getAuth()
             : false;
+	session_id($sid);
+	return $auth_val;
     }
 
     /**
-- 
1.7.3.4