Unserialize Database Session Codeigniter

Question

I do have an issue with Codeigniter Database Session.

To make it short, I don't want multiple login with the same credentials(login/password).

The first verification is made by username/passwod matches in the database.

Here is my code

function index()
{
    // Load Model.
    $this->load->model('membres_model');

    // Check if the user is already logged
    if($this->session->userdata('alias') || $this->session->userdata('logged'))
    {
        //Redirect if he is logged.
        redirect('membres/');
    }
    // If the form has been sent.   
    if($this->input->post('submit'))
    {           
        // Trim data
        $this->form_validation->set_rules('alias','Nom d\'utilisateur','trim|required|xss_clean');
        $this->form_validation->set_rules('motdepasse','Mot de passe','trim|required|xss_clean');

        if($this->form_validation->run())
        {
            // check verification in the model
            if($this->membres_model->verification_connexion($this->input->post('alias'),$this->input->post('motdepasse')))
            {
                // Set userdata variables
                $data = array(
                    'alias'     =>  $this->input->post('alias'),
                    'addr_ip'   =>  $_SERVER['REMOTE_ADDR'],
                    'hote'      =>  gethostbyaddr($_SERVER['REMOTE_ADDR']),
                    'logged'    =>  true
                );

                    /****************************************
                    I Want to verify if the membres is already logged if another one want to use the                        same login/password of the logged on. but I don't know how to verify in the                         ci_sessions
                    *****************************************/

                    // start session
                    $this->session->set_userdata($data);
                    // Redirection sur l'espace membre apres la creation de la session.
                    redirect('membres/');
            }
            else {
                // if return false
                $data['error'] = 'Mauvais identifiants';
                $data['contenu'] = 'connexion/formulaire';
                $this->load->view('includes/template',$data);
            }
        } 
        else {

            $data['contenu'] = 'connexion/formulaire'; // La variable vue pour loader dans le template.
            $this->load->view('includes/template',$data);
        }

    } 
    else {

        $data['contenu'] = 'connexion/formulaire'; // La variable vue pour loader dans le template.
        $this->load->view('includes/template',$data);
    }

}
}

I know I do have to use session Unserialize. I can't get the array but I don't know how to compare the data with the logged user. Does anybody can help me ?

Answer 1

Just add another column (say "user_id") to the sessions table, so you can check it with a single and simple SQL query. unserialize() (you'll need it) is typically a very slow function and checking each row in the sessions table might become an issue.

But ... here's how CodeIgniter unserializes it's session data:

    protected function _unserialize($data)
    {
            $data = @unserialize(strip_slashes($data));

            if (is_array($data))
            {
                    array_walk_recursive($data, array(&$this, '_unescape_slashes'));
                    return $data;
            }

            return (is_string($data)) ? str_replace('{{slash}}', '\\', $data) : $data;
    }

... and here's one called by it:

    protected function _unescape_slashes(&$val, $key)
    {
            if (is_string($val))
            {
                    $val= str_replace('{{slash}}', '\\', $val);
            }
    }

You could've used those directly if they were not protected, but ... it's still probably better that you just extend the Session library instead of implementing it on your own.

Answer 2

You could try something like this:

$sessions = "SELECT * FROM ci_sessions"; // return as object

        foreach($sessions as $sess)
        {
            foreach(unserialize($sess->user_data) as $k => $v)
            {
                if($k === 'alias' AND isset($v))
                {
                    return true;
                }
            }
        }

OR as an alternative you might want to use a cookie

public function _before_check($alias) // alias should have UNIQUE constraint
{
    return ($this->input->cookie('my_cookie_'.$alias, TRUE)) ? TRUE : FALSE;
}

Inside your form validation, do your before check!

if($this->_before_check($alias))
{
   //already logged In
}
else
{
  //log them in AND set your cookie
}

Con: They can bypass this if they attempt login via new computer

Note: you might want to set your expire time to match your session time, ie: 2 hours ( 7200 ).