It's only a 'notice' and from the php message, it has ignored the session trying to start, so I assume there is no cause for alarm.
session_start() is only used in one place in that version of XOOPS, and it is the line mentioned, line 177 in /include/common.php
session_destroy() is found in 2 places, line 73 of user.php, when a user logs out:
if ($op == 'logout') {
$message = '';
$_SESSION = array();
session_destroy();
if ($xoopsConfig['use_mysession'] && $xoopsConfig['session_name'] != '') {
setcookie($xoopsConfig['session_name'], '', time()- 3600, '/', '', 0);
}
// clear entry from online users table
if (is_object($xoopsUser)) {
$online_handler =& xoops_gethandler('online');
$online_handler->destroy($xoopsUser->getVar('uid'));
}
$message = _US_LOGGEDOUT.'<br />'._US_THANKYOUFORVISIT;
redirect_header('index.php', 1, $message);
exit();
}
and line 170 of include/common.php (actually commented out)
// ############## Login a user with a valid session ##############
$xoopsUser = '';
$xoopsUserIsAdmin = false;
$member_handler =& xoops_gethandler('member');
$sess_handler =& xoops_gethandler('session');
if ($xoopsConfig['use_ssl'] && isset($_POST[$xoopsConfig['sslpost_name']]) && $_POST[$xoopsConfig['sslpost_name']] != '') {
session_id($_POST[$xoopsConfig['sslpost_name']]);
} elseif ($xoopsConfig['use_mysession'] && $xoopsConfig['session_name'] != '') {
if (isset($_COOKIE[$xoopsConfig['session_name']])) {
session_id($_COOKIE[$xoopsConfig['session_name']]);
} else {
// no custom session cookie set, destroy session if any
$_SESSION = array();
//session_destroy();
}
if (function_exists('session_cache_expire')) {
session_cache_expire($xoopsConfig['session_expire']);
}
}
session_set_save_handler(array(&$sess_handler, 'open'), array(&$sess_handler, 'close'), array(&$sess_handler, 'read'), array(&$sess_handler, 'write'), array(&$sess_handler, 'destroy'), array(&$sess_handler, 'gc'));
session_start();
I would assume that if people turn on php debug, they will see this 'notice' that you are seeing. But I think any new users for your site are getting redirected, and then a blank page, is that correct ??
So, if that is true, there is cause for concern. I'm rusty on php, but it seems the only way a session is 'destroyed' (and hence the session_start() would cause no errors, is for you to have your own session and session name configured in admin.
Why not turn off php debug, and see if the problem still appears ?
