How to get the User ID in a view

meowman

Ideally, I'd like to get the logged-in user ID from an external PHP script. It looks like too much work to dig into the code and figure out how to do that, so I'm content with just using the /vendor/flarum/core/views/frontend/forum.blade.php file.

From the forum.blade.php file, how would I get the logged-in user's ID?

askvortsov

meowman What are you trying to accomplish?

meowman

askvortsov I need to pass the user ID into an external PHP chat script for automatic logins.

luceos

meowman so the problem you will soon run into is this:

Flarum is a SPA, meaning that css and js are loaded once while you browse through the pages and the backend (php) won't be used on each page visit. Logging in and logging out might cause a refresh, but this is not guaranteed. Once logged in or out, information about which user is authorized is stored inside your local browser with javascript. As such you cannot and should not rely on the forum.blade.php to know who is logged in.

meowman

luceos Thanks for the info. I'll have to dig into the code to authorize the user from an external PHP file then. Any suggestions on where to get started with this?

clarkwinkelmann

meowman can you give us more details on how that login feature would work, maybe point to the third-party documentation for the chat you're using? There are so many way to integrate with users or login flow it's hard to give directions without knowing exactly what you're trying to do.

meowman

clarkwinkelmann Yes, it is for ArrowChat. The exact code of the PHP function that I'm using is:

function get_user_id() 
{
	global $db;
	
	$userid = NULL;

	if (!empty($_COOKIE['flarum_remember'])) 
	{
		$result = $db->execute("
			SELECT user_id 
			FROM " . TABLE_PREFIX . "access_tokens
			WHERE token = '" . $db->escape_string($_COOKIE['flarum_remember']) . "'
		");

		if ($row = $db->fetch_array($result))
		{
			if (!empty($row['user_id']))
			{
				$userid = $row['user_id'];
			}
		}
	}

	return $userid;
}

Flarum_remember works just by searching the database, but only if the user selected the 'Remember Me' option. I need it to work in all situations.

I plan on tapping into the flarum_session cookie instead.

clarkwinkelmann

meowman looking at https://www.arrowchat.com/docs/installation/#get-user-id it seems like you will indeed have to manually read the session since there's no way to call Flarum internals from that other PHP file.

Flarum sessions use the Symfony session package with file sessions. In the session there's a user_id property that contains the ID of the currently logged in user. You will have to either import the Symfony package, or manually write some code to open the symfony session files from Flarum's storage/sessions folder.

meowman

clarkwinkelmann This helps, thank you!

I was able to do this based on your info:

function get_user_id() 
{
	global $db;
	
	$userid = NULL;

	if (!empty($_COOKIE['flarum_session'])) 
	{
		$session_data = file_get_contents(dirname(dirname(dirname(__FILE__))) . '/storage/sessions/' . $_COOKIE['flarum_session']);
		
		$session_data = @unserialize($session_data);
		
		if (!empty($session_data['user_id']))
		{
			$userid = $session_data['user_id'];
		}
	}

	return $userid;
}

and it works! Still cleaning it up...

clarkwinkelmann

meowman nice! Also make sure you handle errors if the session file doesn't exist for some reason 😉

Syirrus

meowman This solution for ArrowChat doesn't work.
Is there an update to the above code?

skowron0

I also wanted to use this code but there is no user_id in the session file. Has it ever been saved there and has it been changed?

r4nchy

skowron0

yes thats true, maybe we will have to query he DB for getting user_id

clarkwinkelmann

In Flarum 1.x the session object contains a property named access_token . You need to query the access_tokens table (on the token column), verify the token exists and has not expired, then you can use the user_id column from the access_tokens table row.

luceos

The easiest solution is probably to make a little extension or local extender to inject the user id into a cookie when logged in and destroy that cookie on log out.

clarkwinkelmann

luceos make sure the cookie is signed though (or a random identifier to another PHP/Symfony session object that contains the desired value), because otherwise depending on the implementation someone could use this to access unauthorized information by sending a malicious cookie.

Wadera

I needed to integrate it recently for one of my clients. That should do the job:

        function get_user_id() {
                global $db;
                $userid = NULL;

                if (!empty($_COOKIE['flarum_session'])) {
                    $filePath = dirname(dirname(dirname(__FILE__))) . '/storage/sessions/' . $_COOKIE['flarum_session'];
                    if (file_exists($filePath)){
                        $file_data = file_get_contents($filePath);
                        $session_data = unserialize($file_data);

                        if (!empty($session_data['user_id'])) {
                            $userid = $session_data['user_id'];
                        }
                    }
                }

                $result = $db->execute("SELECT user_id FROM access_tokens WHERE token = '" . $db->escape_string($session_data['access_token']) . "'");
        
                if ($result && $db->count_select() > 0) {
                    $row = $db->fetch_array($result);
                    $userid = $row['user_id'];
                } 

            return $userid;
        }