discuz 登录cookie有效期设置解析

discuz在source\class\class_member.php脚本中函数on_login内进行验证登录信息，以下是验证代码

$result = userlogin($_GET['username'], $_GET['password'], $_GET['questionid'], $_GET['answer'], $this->setting['autoidselect'] ? 'auto' : $_GET['loginfield'], $_G['clientip']);

如果验证正确（$result['status']
> 0），接下来

setloginstatus($result['member'], $_GET['cookietime'] ? 2592000 : 0);

进行cookie信息写入，其中 $_GET['cookietime'] 在普通登录时，没传，所以，setloginstatus得第二各参数传的是0，这个0标记一下，继续看setloginstatus，

function setloginstatus($member, $cookietime) {

global $_G;

$_G['uid'] = intval($member['uid']);

$_G['username'] = $member['username'];

$_G['adminid'] = $member['adminid'];

$_G['groupid'] = $member['groupid'];

$_G['formhash'] = formhash();

$_G['session'<
19fa4
span class="pun" style="color:rgb(147,161,161);">]['invisible'] = getuserprofile('invisible');

$_G['member'] = $member;

loadcache('usergroup_'.$_G['groupid']);

C::app()->session->isnew = true;

C::app()->session->updatesession();

dsetcookie('auth', authcode("{$member['password']}\t{$member['uid']}", 'ENCODE'), $cookietime, 1, true);

dsetcookie('loginuser');

dsetcookie('activationauth');

dsetcookie('pmnum');

include_once libfile('function/stat');

updatestat('login', 1);

if(defined('IN_MOBILE')) {

updatestat('mobilelogin', 1);

}

if($_G['setting']['connect']['allow'] && $_G['member']['conisbind']) {

updatestat('connectlogin', 1);

}

$rule = updatecreditbyaction('daylogin', $_G['uid']);

if(!$rule['updatecredit']) {

checkusergroup($_G['uid']);

}

}

其中记录用户登录信息的核心部分就是

dsetcookie('auth', authcode("{$member['password']}\t{$member['uid']}", 'ENCODE'), $cookietime, 1, true);

$cookietime就是setloginstatus传入的第二参数，继续为0，接下来解析dsetcookie

function dsetcookie($var, $value = '', $life = 0, $prefix = 1, $httponly = false) {

global $_G;

$config = $_G['config']['cookie'];

$_G['cookie'][$var] = $value;

$var = ($prefix ? $config['cookiepre'] : '').$var;

$_COOKIE[$var] = $value;

if($value == '' || $life < 0) {

$value = '';

$life = -1;

}

if(defined('IN_MOBILE')) {

$httponly = false;

}

$life = $life > 0 ? getglobal('timestamp') + $life : ($life < 0 ? getglobal('timestamp') - 31536000 : 0);

if(strstr($var,"_auth")){

discuz_error::write_error_log("<br>".var_export($_COOKIE[$var],true)."<br>");

}

$path = $httponly && PHP_VERSION < '5.2.0' ? $config['cookiepath'].'; HttpOnly' : $config['cookiepath'];

$secure = $_SERVER['SERVER_PORT'] == 443 ? 1 : 0;

if(PHP_VERSION < '5.2.0') {

setcookie($var, $value, $life, $path, $config['cookiedomain'], $secure);

} else {

setcookie($var, $value, $life, $path, $config['cookiedomain'], $secure, $httponly);

}

if(strstr($var,"_auth")){

discuz_error::write_error_log("<br>".$life.'_'.$var.'_'.var_export($_COOKIE[$var],true)."<br>");

}

}

两个地方设置了cookie，第一就是上面标蓝的

$_COOKIE[$var] = $value;

直接将，auth传入cookie，然后又在后面的标蓝处，进行第二次cookie值的设置，

setcookie($var, $value, $life, $path, $config['cookiedomain'], $secure, $httponly);

$life，在传入时，如果小于0，或者，$var为空时，$life被赋值为-1，接下来$life根据值-1，重新赋值为getglobal('timestamp') - 31536000，在执行setcookie时，就把$_COOKIE[$var]给清空，如果$life传入时大于0，在执行setcookie前，$life被赋值为getglobal('timestamp')
+ $life，之前函数传入的$life，就是该$_COOKIE[$var]的有效期。下面是重点，在登陆时，$life被传入时为0，执行setcookie时，$life也就是cookie的过期值也是为0，在php官方手册中的解释是

bool setcookie ( string $name [, string $value = "" [, int $expire = 0 [, string $path = "" [, string $domain = "" [, bool $secure = false [, bool $httponly = false ]]]]]] )

expire
The time the cookie expires. This is a Unix timestamp so is in number of seconds since the epoch. In other words, you'll most likely set this with the time() function plus the number of seconds before you want it to expire. Or you might
use mktime(). time()+60*60*24*30 will set the cookie to expire in 30 days. If set to 0, or omitted, the cookie will expire at the end of the session (when the browser closes).

其中，标蓝处的意思就是，当cookie的过期时间$expire为0，或是没有设置时，cookie的保存时间与浏览器进程一致，在浏览器进程未关闭状态，cookie均会存在，浏览器关闭后cookie会消失，就是说在普通登录时，记录用户登录状态的函数，设置的cookie有效期就是浏览器打开该网站的有效期，关闭后，cookie值随之消失。

另外，用户在登录时选择，自动登录，如下图

<input type="checkbox" class="pc" name="cookietime" id="cookietime_Lz363" tabindex="1" value="2592000" fwin="login">

在执行setloginstatus,传入的$cookietime的就是2592000，进而，将该该值传入cookie，也就是dsetcookie的$life大于0，并且值为2592000,用户的登录状态存在时间就是2592000（60*60*24*30），30天。