By samchok on

Hello,
I'm trying to get the current user's roles from an external php script (I just need to check if the current user is the administrator).
The script resides into the theme directory, and starts like this:

chdir('./../../../../'); // for relative path includes to work
include_once "includes/bootstrap.inc";
drupal_bootstrap(DRUPAL_BOOTSTRAP_FULL);
global $user;
if(in_array('administrator', $user->roles)) {
     print "You are the admin!";
}

The problem is that the $user variable always contains uid '0' (aka 'guest' user), even if a user with 'administrator' role is logged, no matter what.

Am I doing something wrong?
Thank you.

⋅ Categories: Drupal 6.x

Comments

nevets’s picture

nevets commented

How are you invoking the script, from a browser or command line?

samchok’s picture

samchok commented

Via browser.
It is an AJAX invoked script. Basically the user clicks on a button and the script make some job on an external DB.
I just need to ensure that the user running the script is an admin.

samchok’s picture

samchok commented

really no idea?! :-|

jmmec’s picture

jmmec commented

Hmm... I'm stumped, but I would think that your bootstrap approach would give you the entire Drupal environment, including the setting of the $user global. I'm assuming that the browser that is running your script (sending AJAX) already has a session established with your server for the admin account? If it doesn't, then that would explain why Drupal doesn't think you are logged in.

In my case (on a private website), I only boot up to "DRUPAL_BOOTSTRAP_DATABASE" (i.e. <100ms response time compared to 1sec or greater), so I pass the "uid" as part of my AJAX message from the browser to the server. In my case, my users aren't going to try to hack my scripts, and anyway, the stuff they are accessing via AJAX is not a security risk.

Regards

samchok’s picture

samchok commented

Thank you jmmec for your answer,
the admin is already athenticated on the Drupal website, then he clicks on a button that invokes the AJAX script. I suppose that I should be able to get admin's session this way...

I know your approach is faster, but I'm more concerned on security issues than on speed: passing the UID in the AJAX request can be easily hacked (you just need to inspect the Firebug console to know which parameters your script is expecting... and then you can manually execute that script with the admin UID...).

I still made a few attempts, but I really can't understand why the session is lost between Drupal and my AJAX script... :-/

EDIT: I tried with the 'DRUPAL_BOOTSTRAP_SESSION' variable, taht should only initialize sasson handling, but the problem is still there.

jmmec’s picture

jmmec commented

Yes, your experience doesn't make sense to me, especially since you are doing a full bootup. :|

If you haven't already, I would recommend comparing your code with contributed AJAX modules and see what the difference may be. It seems to me that your approach should be working.

Regards

samchok’s picture

samchok commented

Strange thing is that on another drupal installation (with different installed modules) I used the same code and it all works just fine!
I really have no idea where the difference could be...

sequoiadrake’s picture

sequoiadrake commented

Maybe this would explain :
http://drupal.org/node/777866

gdesmarais’s picture

gdesmarais commented

I ended up have the same problem when using AJAX calls from Drupal pages. I have a bit of a non traditional Drupal deployment where my Page simply include()'s another PHP file for all the page operations (this is to make it easy to migrate to other CMS/CCSs later). The included page used non-drupal specific forms with a lot of ajax for loading lists, validating, submitting, etc. The target AJAX php code tried to retrieve the $user object, but it was always empty. I think in the grand scheme, my process is nearly identical to yours. The bootstrap process mentioned worked perfectly - even without the cookie setting mentioned. Thanks all - you helped a lot.

Oh yea - I think the comment about security is an important one to note. All those AJAXish pages are _very_ exposed - you have to take extra care with them.

danielschroeder’s picture

danielschroeder commented

'lil late, but this is the solution:

You need to define $base_url before bootstrap:

$base_url = 'http://'.$_SERVER['HTTP_HOST'];
chdir('./../../../../'); // for relative path includes to work
include_once "includes/bootstrap.inc";
drupal_bootstrap(DRUPAL_BOOTSTRAP_FULL); //DRUPAL_BOOTSTRAP_SESSION
global $user;

echo $user->uid

charlie-s’s picture

charlie-s commented

In D7 the normal bootstrap starts with define('DRUPAL_ROOT', [path]); which you could just use like follows:

<?php
define('DRUPAL_ROOT', $_SERVER['DOCUMENT_ROOT']);
$base_url = 'http://'.$_SERVER['HTTP_HOST']; // THIS IS IMPORTANT
require_once DRUPAL_ROOT . '/includes/bootstrap.inc';
drupal_bootstrap(DRUPAL_BOOTSTRAP_FULL);

// ... do something ...
global $user;
print_r($user);
?>
owntheweb’s picture

owntheweb commented

Thank you! Thank you, thank you.

This worked for my D7 website. Thanks for your note csdco. :D

Worlds to explore. Worlds to create.
Blog: http://www.christopherstevens.cc/blog
Twitter: http://www.twitter.com/owntheweb

twistedindustries’s picture

twistedindustries commented

I am using this code and it is including drupal_bootstrap. I can confirm this by manually calling user_load and then I can print_r the results. But when I try to check the global $user variable it is always empty whether I am logged in or not. I am using 6.26 and have updated the cookie_domain parameter in the settings file. Any insight?