Persistent Login across multisite on subdomains

Your patch introduces a security hole by allowing HTTP header injection via the Host header. Instead of trying to sanitize $_SERVER['HTTP_HOST'], I suggest using session.cookie_domain if it is set and the default value (by specifying the empty string) if it is unset.

So, try the attached patch and let me know if it works.

I just noticed you submitted this issue against the 4.7 version of PL. So, use this patch instead.

seems like a useful feature. i run groups.drupal.org and groupsbeta.drupal.org so this could affect me slightly.

Thanks for this solution ahoeben!

I have just implemented a slightly modified version of it for a customer and it seems to work well. The sites are running Drupal 5.5.

In later versions of Drupal 5 you have this line in settings.php.

$cookie_domain = 'example.com';

My patch tells Persistent Login module to use the "cookie_domain" variable when it sets its cookie.

I have set the "cookie_domain" to the same domain.tld for the two sites and I'm sharing the following tables.

  'authmap'                => 'shared_db.',
  'persistent_login'       => 'shared_db.',
  'profile_fields'         => 'shared_db.',
  'profile_values'         => 'shared_db.',
  'sequences'              => 'shared_db.',
  'sessions'               => 'shared_db.',
  'users'                  => 'shared_db.',

Before this the sites used the Singlesignon module and it worked but we got cache related problems, blank pages, for anonymus users.

Latest solution looks good, though patch does not apply.

Oh, setcookie() is also used to expire the PL cookie at logout time.

Oh, here's more food for thinking... wouldn't it be nice to compute the PL cookie in a similar way the Drupal session cookie name is computed, just prefixed with 'PLSESS' or something similar?

Drupal session name is based on $cookie_domain or the host name in $base_url if cookie domain is undefined on bootstrap session phase.

Re-rolled patch from #4, but also using $cookie_domain when setcookie is invoked to remove the PL at user logout time.

Attached patch is for the 5.x version of the PL module.

Attached patch is the same as above, but for the 6.x version of the PL module (actually HEAD).

Fixed in CVS for D5 and D6 versions of PL.