- $_SESSION['uid'] = $record['uid'];
- $_SESSION['theme'] = $record['theme'];
- $_SESSION['authenticated'] = 1;
- $_SESSION['page_flags'] = $record['page-flags'];
- $_SESSION['my_url'] = $a->get_baseurl() . '/profile/' . $record['nickname'];
- $_SESSION['addr'] = $_SERVER['REMOTE_ADDR'];
-
- $a->user = $record;
-
- if($a->user['login_date'] === '0000-00-00 00:00:00') {
- $_SESSION['return_url'] = 'profile_photo/new';
- $a->module = 'profile_photo';
- info( t("Welcome ") . $a->user['username'] . EOL);
- info( t('Please upload a profile photo.') . EOL);
- }
- else
- info( t("Welcome back ") . $a->user['username'] . EOL);
-
-
- $member_since = strtotime($a->user['register_date']);
- if(time() < ($member_since + ( 60 * 60 * 24 * 14)))
- $_SESSION['new_member'] = true;
- else
- $_SESSION['new_member'] = false;
-
- if(strlen($a->user['timezone'])) {
- date_default_timezone_set($a->user['timezone']);
- $a->timezone = $a->user['timezone'];
+ // If the user specified to remember the authentication, then change the cookie
+ // to expire after one year (the default is when the browser is closed).
+ // If the user did not specify to remember, change the cookie to expire when the
+ // browser is closed. The reason this is necessary is because if the user
+ // specifies to remember, then logs out and logs back in without specifying to
+ // remember, the old "remember" cookie may remain and prevent the session from
+ // expiring when the browser is closed.
+ //
+ // It seems like I should be able to test for the old cookie, but for some reason when
+ // I read the lifetime value from session_get_cookie_params(), I always get '0'
+ // (i.e. expire when the browser is closed), even when there's a time expiration
+ // on the cookie
+ if($_POST['remember']) {
+ new_cookie(31449600); // one year