Commit bdf30ec9 authored by Leigh Stoller's avatar Leigh Stoller

Redo the login/logout stuff so that the front page can default to http

instead of https. Present doc links as http all the time.  Required
lot of little changes.
parent 141daa6e
......@@ -3,13 +3,13 @@
# Default definitions. Selected via configure.
#
$WWW = "www.emulab.net";
$TBWWW = "<https://$WWW/>";
$TBBASE = "https://$WWW/";
#$TBDOCBASE = "http://$WWW/";
$TBDOCBASE = "https://$WWW/";
$TBBASE = "https://$WWW";
$TBDOCBASE = "http://$WWW";
$TBWWW = "<$TBBASE/>";
$TBMAIL_OPS = "Testbed Ops <testbed-ops@flux.cs.utah.edu>";
$TBMAIL_WWW = "Testbed WWW <testbed-www@flux.cs.utah.edu>";
$TBMAIL_APPROVAL= "Testbed Approval <testbed-approval@flux.cs.utah.edu>";
$TBMAIL_LOGS = "Testbed Logs <testbed-logs@fast.cs.utah.edu>";
$TBAUTHDOMAIN = ".emulab.net";
$TBSECURECOOKIES= 1;
?>
......@@ -8,8 +8,8 @@ PAGEHEADER("Documentation");
?>
<ul>
<li><b><a href="docwrapper.php3?docname=tutorial/tutorial.html">
Emulab "Getting Started" Tutorial</a></b>
<li><b><a href="tutorial/tutorial.php3">
Emulab "Getting Started" Tutorial</a></b>
<p>
<li><b><a href="docwrapper.php3?docname=faq.html">
......
......@@ -4,55 +4,6 @@
#
require("defs.php3");
#
# This page gets loaded either as the result of a login/logout click,
# or as a regular page cause its the base. We deal with login and
# logout right here. Once that is done, we can move onto writing the
# actual page contents. The current login status is checked when the
# menu bar is written, and by the pages themselves when they care.
#
# $uid will be set by the login/logout form. We need to set $login_uid
# (global variable if a valid login. This is for the menu generation.
#
if (isset($login)) {
#
# Login button pressed.
#
if (!isset($uid) ||
strcmp($uid, "") == 0) {
$login_status = $STATUS_LOGINFAIL;
}
else {
#
# Look to see if already logged in. If the user hits reload,
# we are going to get another login post, and this could
# update the current login. Try to avoid that if possible.
#
if (CHECKLOGIN($uid) == 1) {
$login_status = $STATUS_LOGGEDIN;
$login_uid = $uid;
}
elseif (DOLOGIN($uid, $password)) {
$login_status = $STATUS_LOGINFAIL;
}
else {
$login_status = $STATUS_LOGGEDIN;
$login_uid = $uid;
}
}
}
elseif (isset($logout)) {
#
# Logout button pressed.
#
DOLOGOUT($uid);
$login_status = $STATUS_LOGGEDOUT;
}
#
# Don't need this anymore. Avoid confusion.
#
unset($uid);
#
# Standard Testbed Header
#
......
<?php
#
# Beware empty spaces (cookies)!
#
require("defs.php3");
#
# This page gets loaded as the result of a login click.
#
# $uid will be set by the login form. If the login is okay, we zap
# the user back to the main page. If the login fails, put continue
# with a normal page, but with an error message.
#
if (isset($login)) {
#
# Login button pressed.
#
if (!isset($uid) ||
strcmp($uid, "") == 0) {
$login_status = $STATUS_LOGINFAIL;
}
else {
#
# Look to see if already logged in. If the user hits reload,
# we are going to get another login post, and this could
# update the current login. Try to avoid that if possible.
#
if (CHECKLOGIN($uid) == 1) {
$login_status = $STATUS_LOGGEDIN;
}
elseif (DOLOGIN($uid, $password)) {
$login_status = $STATUS_LOGINFAIL;
}
else {
$login_status = $STATUS_LOGGEDIN;
}
}
}
else {
$login_status = $STATUS_LOGGEDIN;
}
if ($login_status == $STATUS_LOGGEDIN) {
header("Location: " . "index.php3");
return;
}
#
# Standard Testbed Header
#
PAGEHEADER("Login Failed");
echo "<center><h3>Login attempt failed! Please try again.</h3></center>\n";
#
# Standard Testbed Footer
#
PAGEFOOTER();
?>
<?php
include("defs.php3");
#
# Standard Testbed Header
#
PAGEHEADER("Login");
#
# Get the UID that came back in the cookie so that we can present a
# default login name to the user. If there is a UID from the browser,
# and the user is still logged in, then skip the form. Gotta log out
# first.
#
if (($known_uid = GETUID()) != FALSE) {
if (CHECKLOGIN($known_uid) == $CHECKLOGIN_LOGGEDIN) {
echo "<h3>
You are still logged in. Please log out first if you want
to log in as another user!
</h3>\n";
PAGEFOOTER();
die("");
}
}
else {
$known_uid = "";
}
echo "<center><h3>
Please login to our secure server.<br>
(You must have cookies enabled)
</h3></center>\n";
echo "<table align=center border=1>\n";
echo "<form action=\"${TBBASE}/login.php3\" method=post>\n";
echo "<tr>
<td>Username:</td>
<td><input type=text value=\"$known_uid\" name=uid size=8></td>
</tr>
<tr>
<td>Password:</td>
<td><input type=password name=password size=12></td>
</tr>
<tr>
<td align=center colspan=2>
<b><input type=submit value=Login name=login></b></td>
</tr>\n";
echo "</form>\n";
echo "</table>\n";
#
# Standard Testbed Footer
#
PAGEFOOTER();
?>
www/logoff.gif

370 Bytes

www/logon.gif

360 Bytes

<?php
#
# Beware empty spaces (cookies)!
#
require("defs.php3");
#
# This page gets loaded as the result of a logout click.
#
# $uid comes in as a variable.
#
if (isset($uid) && strcmp($uid, "")) {
DOLOGOUT($uid);
unset($uid);
#
# Zap the user back to the front page, in nonsecure mode.
#
header("Location: $TBBASE/");
return;
}
#
# Standard Testbed Header
#
PAGEHEADER("Logout");
echo "<center><h3>Logout attempt failed!</h3></center>\n";
#
# Standard Testbed Footer
#
PAGEFOOTER();
?>
......@@ -11,13 +11,19 @@ $login_message = "";
$error_message = 0;
$login_uid = 0;
#
# This has to be set so we can spit out http or https paths properly!
# Thats because browsers do not like a mix of secure and nonsecure.
#
$BASEPATH = "";
#
# WRITESIDEBARBUTTON(text, link): Write a button on the sidebar menu.
# We do not currently try to match the current selection so that its
# link looks different. Not sure its really necessary.
#
function WRITESIDEBARBUTTON($text, $base, $link) {
$link = "$base" . "$link";
$link = "$base/$link";
echo "<!-- Table row for button $text -->
<tr>
......@@ -43,11 +49,15 @@ function WRITESIDEBAR() {
global $login_status, $login_message, $error_message, $login_uid;
global $STATUS_NOSTATUS, $STATUS_LOGGEDIN, $STATUS_LOGGEDOUT;
global $STATUS_LOGINFAIL, $STATUS_TIMEDOUT, $STATUS_NOLOGINS;
global $TBBASE, $TBDOCBASE, $TBDBNAME;
global $TBBASE, $TBDOCBASE, $TBDBNAME, $BASEPATH;
#
# The document base cannot be a mix of secure and nonsecure.
#
echo "<table cellspacing=2 cellpadding=2 border=0 width=150>\n";
WRITESIDEBARBUTTON("Home", $TBBASE, "index.php3");
WRITESIDEBARBUTTON("Home", $TBDOCBASE, "index.php3");
WRITESIDEBARBUTTON("Publications", $TBDOCBASE, "pubs.php3");
WRITESIDEBARBUTTON("Documentation", $TBDOCBASE, "doc.php3");
WRITESIDEBARBUTTON("FAQ", $TBDOCBASE, "faq.php3");
......@@ -169,47 +179,30 @@ function WRITESIDEBAR() {
#
# Now the login/logout box. Remember, already inside a table.
# We want the links to the login/logout pages to always be https,
# but the images path depends on whether the page was loaded as
# http or https, since we don't want to mix them, since they
# cause warnings.
#
echo "<form action=\"${TBBASE}index.php3\" method=post>\n";
if ($login_status == $STATUS_LOGGEDIN) {
echo "<tr>
<td><input type=hidden name=uid value=\"$login_uid\"></td>
</tr>
<tr>
<td align=center>
<b><input type=submit value=Logout name=logout></b>
</td>
<td align=center height=50 valign=center>
<a href=\"$TBBASE/logout.php3?uid=$login_uid\">
<img alt=\"logout\" border=0
src=\"$BASEPATH/logoff.gif\"></a>
</td>
</tr>\n";
}
else {
#
# Get the UID that came back in the cookie so that we can present a
# default login name to the user.
#
if (($known_uid = GETUID()) == FALSE) {
$known_uid = "";
}
echo "<tr>
<td>
Username:<br>
<input type=text value=\"$known_uid\"
name=uid size=8>
</td>
</tr>
<tr>
<td>
Password:<br>
<input type=password name=password size=12>
</td>
</tr>
<tr>
<td align=center>
<b><input type=submit value=Login name=login></b>
</td>
<td align=center height=50 valign=center>
<a href=\"$TBBASE/login_form.php3\">
<img alt=\"logon\" border=0
src=\"$BASEPATH/logon.gif\"></a>
</td>
</tr>\n";
}
echo "</form>\n";
if ($login_message) {
echo "<tr>
<td align=center>
......@@ -319,32 +312,48 @@ function PAGEHEADER($title) {
global $STATUS_NOSTATUS, $STATUS_LOGGEDIN, $STATUS_LOGGEDOUT;
global $STATUS_LOGINFAIL, $STATUS_TIMEDOUT, $STATUS_NOLOGINS;
global $TBBASE, $TBDOCBASE, $TBDBNAME;
global $CHECKLOGIN_NOTLOGGEDIN, $CHECKLOGIN_LOGGEDIN;
global $CHECKLOGIN_TIMEDOUT, $CHECKLOGIN_MAYBEVALID;
global $BASEPATH, $SSL_PROTOCOL;
#
# Determine the proper basepath, which depends on whether the page
# was loaded as http or https. This lets us be consistent in the URLs
# we spit back, so that users do not get those pesky warnings. These
# warnings are generated when a page *loads* (say, images, style files),
# a mix of http and https. Links can be mixed, and in fact when there
# is no login active, we want to spit back http for the documentation,
# but https for the start/join pages.
#
if (isset($SSL_PROTOCOL)) {
$BASEPATH = $TBBASE;
}
else {
$BASEPATH = $TBDOCBASE;
}
#
# $login_uid will be set only when the index page is loaded, which
# is where the login/logout box is handled. Otherwise, there will
# be no $login_status, and $login_uid will be zero. We need to figure
# that out so we can generate the proper menu options for the user.
# Figure out who is logged in, if anyone.
#
if ($login_status == $STATUS_NOSTATUS) {
if (($known_uid = GETUID()) != FALSE) {
#
# Check to make sure the UID is logged in (not timed out).
#
$status = CHECKLOGIN($known_uid);
switch ($status) {
case 0:
$login_uid = 0;
break;
case 1:
$login_status = $STATUS_LOGGEDIN;
$login_uid = $known_uid;
break;
case -1:
$login_status = $STATUS_TIMEDOUT;
$login_uid = 0;
break;
}
if (($known_uid = GETUID()) != FALSE) {
#
# Check to make sure the UID is logged in (not timed out).
#
$status = CHECKLOGIN($known_uid);
switch ($status) {
case $CHECKLOGIN_NOTLOGGEDIN:
$login_status = $STATUS_NOSTATUS;
$login_uid = 0;
break;
case $CHECKLOGIN_LOGGEDIN:
case $CHECKLOGIN_MAYBEVALID:
$login_status = $STATUS_LOGGEDIN;
$login_uid = $known_uid;
break;
case $CHECKLOGIN_TIMEDOUT:
$login_status = $STATUS_TIMEDOUT;
$login_uid = 0;
break;
}
}
......@@ -395,7 +404,8 @@ function PAGEHEADER($title) {
</script>\n";
}
echo " <link rel=\"stylesheet\" href=\"$TBBASE/tbstyle.css\"
echo " <meta HTTP-EQUIV=\"Pragma\" CONTENT=\"no-cache\">
<link rel=\"stylesheet\" href=\"$BASEPATH/tbstyle.css\"
type=\"text/css\">
</head>\n";
......@@ -410,7 +420,7 @@ function PAGEHEADER($title) {
}
echo "<basefont size=4>\n";
WRITEBANNER($title);
WRITETITLE($title);
......@@ -449,13 +459,13 @@ function ENDPAGE() {
# Spit out a vanilla page footer.
#
function PAGEFOOTER() {
global $TBBASE, $TBMAILADDR;
global $TBDOCBASE, $TBMAILADDR;
ENDPAGE();
echo "<!-- Force full window! -->
<base target=_top>
<center>[<a href=\"$TBBASE\">Emulab.Net Home</a>]</center>
<center>[<a href=\"$TBDOCBASE\">Emulab.Net Home</a>]</center>
<center>
[<a href=\"http://www.cs.utah.edu/flux/\">Flux Research Group</a>]
[<a href=\"http://www.cs.utah.edu/\">School of Computing</a>]
......
......@@ -3,12 +3,13 @@
# Mac's definitions. Selected via configure.
#
$WWW = "www.emulab.net/~newbold/www";
$TBWWW = "<https://$WWW>";
$TBBASE = "https://$WWW/";
$TBDOCBASE = "http://$WWW/";
$TBBASE = "https://$WWW";
$TBDOCBASE = "http://$WWW";
$TBWWW = "<$TBBASE/>";
$TBMAIL_OPS = "Newbold TB Ops <newbold@cs.utah.edu>";
$TBMAIL_WWW = "Newbold TB WWW <newbold@cs.utah.edu>";
$TBMAIL_APPROVAL= "Newbold TB Approval <newbold@cs.utah.edu>";
$TBMAIL_LOGS = "Newbold TB Logs <newbold@cs.utah.edu>";
$TBAUTHDOMAIN = ".emulab.net";
$TBSECURECOOKIES= 1;
?>
......@@ -14,7 +14,7 @@
<h3>Documents:</h3>
<ul>
<li> <a href = "http://www.cs.utah.edu/flux/testbed/glossy.pdf">
<li> <a href = "http://www.cs.utah.edu/flux/testbed-docs/glossy.pdf">
A one-page "glossy" testbed overview</a>
</ul>
......@@ -22,20 +22,20 @@
<h3>Talks:</h3>
<ul>
<li> SIGCOMM'99 New Research Session,
in <a href="http://www.cs.utah.edu/flux/testbed/sigcomm99-wip.ppt">
Powerpoint</a>and
<a href="http://www.cs.utah.edu/flux/testbed/sigcomm99-wip/index.htm">
HTML</a> formats.
in <a href="http://www.cs.utah.edu/flux/testbed-docs/sigcomm99-wip.ppt">
Powerpoint</a>and
<a href="http://www.cs.utah.edu/flux/testbed-docs/sigcomm99-wip/index.htm">
HTML</a> formats.
<li> SOSP'99 Work-in-progress talk,
in <a href="http://www.cs.utah.edu/flux/testbed/sosp99-wip.ppt">
Powerpoint</a>and
<a href="http://www.cs.utah.edu/flux/testbed/sosp99-wip/index.htm">
HTML</a> formats.
in <a href="http://www.cs.utah.edu/flux/testbed-docs/sosp99-wip.ppt">
Powerpoint</a>and
<a href="http://www.cs.utah.edu/flux/testbed-docs/sosp99-wip/index.htm">
HTML</a> formats.
<li> Utah CHPC Cluster workshop slides, with lots of goofy pictures,
in <a href="http://www.cs.utah.edu/flux/testbed/testbed-chpc.ppt">
Powerpoint</a> and
<a href="http://www.cs.utah.edu/flux/testbed/testbed-chpc/index.htm">
HTML</a> formats.
in <a href="http://www.cs.utah.edu/flux/testbed-docs/testbed-chpc.ppt">
Powerpoint</a> and
<a href="http://www.cs.utah.edu/flux/testbed-docs/testbed-chpc/index.htm">
HTML</a> formats.
</ul>
......@@ -206,6 +206,15 @@ function SHOWEXP($pid, $eid) {
$exp_end = $exprow[expt_end];
$exp_created = $exprow[expt_created];
$exp_head = $exprow[expt_head_uid];
$exp_ready = $exprow[expt_ready];
$exp_term = $exprow[expt_terminating];
if ($exp_ready)
$exp_status = "Ready";
elseif ($exp_term)
$exp_status = "Terminating";
else
$exp_status = "Configuring";
#
# Generate the table.
......@@ -254,6 +263,11 @@ function SHOWEXP($pid, $eid) {
<td class=\"left\">$exp_expires</td>
</tr>\n";
echo "<tr>
<td>Status: </td>
<td class=\"left\">$exp_status</td>
</tr>\n";
echo "</table>\n";
}
......
......@@ -5,12 +5,20 @@
# The point of this file is so that when people go to www.emulab.net
# they will be redirected from http://www.emulab.net/index.html to
# https://www.emulab.net/start.php3, so that we can force certain traffic
# through the secure server instead of the plain server. $TBBASE sets the
# base pointer for the secure server.
# through the secure server instead of the plain server.
#
require("defs.php3");
header("Location: " . "$TBBASE" . "index.php3");
#
# We want to redirect to emulab, not paper. This needs to be fixed!
#
if (isset($SSL_PROTOCOL)) {
$LOC = "$TBBASE/index.php3";
}
else {
$LOC = "$TBDOCBASE/index.php3";
}
?>
header("Location: $LOC");
?>
......@@ -3,12 +3,13 @@
# Leigh's definitions. Selected via configure.
#
$WWW = "www.emulab.net/~stoller/www";
$TBWWW = "<https://$WWW>";
$TBBASE = "https://$WWW/";
$TBDOCBASE = "http://$WWW/";
$TBBASE = "https://$WWW";
$TBDOCBASE = "http://$WWW";
$TBWWW = "<$TBBASE/>";
$TBMAIL_OPS = "Testbed Ops <stoller@fast.cs.utah.edu>";
$TBMAIL_WWW = "Testbed WWW <stoller@fast.cs.utah.edu>";
$TBMAIL_APPROVAL= "Testbed Approval <stoller@fast.cs.utah.edu>";
$TBMAIL_LOGS = "Testbed Logs <stoller@fast.cs.utah.edu>";
$TBAUTHDOMAIN = ".emulab.net";
$TBSECURECOOKIES= 1;
?>
......@@ -3,12 +3,13 @@
# Leigh's definitions. Selected via configure.
#
$WWW = "golden-gw.ballmoss.com:8080/~stoller/testbed";
$TBWWW = "<http://$WWW/>";
$TBBASE = "http://$WWW/";
$TBDOCBASE = "http://$WWW/";
$TBBASE = "http://$WWW";
$TBDOCBASE = "http://$WWW";
$TBWWW = "<$TBBASE/>";
$TBMAIL_OPS = "Testbed Ops <stoller@fast.cs.utah.edu>";
$TBMAIL_WWW = "Testbed WWW <stoller@fast.cs.utah.edu>";
$TBMAIL_APPROVAL= "Testbed Approval <stoller@fast.cs.utah.edu>";
$TBMAIL_LOGS = "Testbed Logs <stoller@fast.cs.utah.edu>";
$TBAUTHDOMAIN = "golden-gw.ballmoss.com";
$TBAUTHDOMAIN = ".ballmoss.com";
$TBSECURECOOKIES= 0;
?>
<?php
#
# Login support: Beware empty spaces (cookies)!
#
#
$CHECKLOGIN_NOTLOGGEDIN = 0;
$CHECKLOGIN_LOGGEDIN = 1;
$CHECKLOGIN_TIMEDOUT = -1;
$CHECKLOGIN_MAYBEVALID = 2;
#
# Generate a hash value suitable for authorization. We use the results of
......@@ -26,10 +31,12 @@ function GENHASH() {
# logged in.
#
function GETLOGIN() {
global $CHECKLOGIN_LOGGEDIN;
if (($uid = GETUID()) == FALSE)
return FALSE;
if (CHECKLOGIN($uid) == 1)
if (CHECKLOGIN($uid) == $CHECKLOGIN_LOGGEDIN)
return $uid;
return FALSE;
......@@ -51,18 +58,21 @@ function GETUID() {
}
#
# Verify a login by sucking a UID's current hash value out of the database.
# Verify a login by sucking a UIDs current hash value out of the database.
# If the login has expired, or of the hashkey in the database does not
# match what came back in the cookie, then the UID is no longer logged in.
#
# Should we advance the timeout since the user is still being active?
#
# Returns: 0 if not logged in ever.
# 1 if logged in okay
# -1 if login timed out
# Returns: if not logged in ever.
# if logged in okay
# if login timed out
# if login record exists, is not timed out, but no hash cookie.
# this case will be caught later when the user tries to do
# something for which a valid login is required.
#
function CHECKLOGIN($uid) {
global $TBDBNAME, $TBAUTHCOOKIE, $HTTP_COOKIE_VARS, $TBAUTHTIMEOUT;
global $CHECKLOGIN_NOTLOGGEDIN, $CHECKLOGIN_LOGGEDIN;
global $CHECKLOGIN_TIMEDOUT, $CHECKLOGIN_MAYBEVALID;
$curhash = $HTTP_COOKIE_VARS[$TBAUTHCOOKIE];
......@@ -75,30 +85,39 @@ function CHECKLOGIN($uid) {
# Not logged in.
if (($row = mysql_fetch_array($query_result)) == 0) {
return 0;
return $CHECKLOGIN_NOTLOGGEDIN;
}
$hashkey = $row[hashkey];
$timeout = $row[timeout];
# A match?
if ($timeout > time() &&
strcmp($curhash, $hashkey) == 0) {
#
# We update the time in the database. Basically, each time the
# user does something, we bump the logout further into the future.
# This avoids timing them out just when they are doing useful work.
#
$timeout = time() + $TBAUTHTIMEOUT;
$query_result = mysql_db_query($TBDBNAME,
"UPDATE login set timeout='$timeout' ".
"WHERE uid=\"$uid\"");
if (! $query_result) {
$err = mysql_error();
TBERROR("Database Error updating login timeout for $uid: $err", 1);
}
return 1;
if ($timeout > time()) {
if (strcmp($curhash, $hashkey) == 0) {
#
# We update the time in the database. Basically, each time the
# user does something, we bump the logout further into the future.
# This avoids timing them out just when they are doing useful work.
#
$timeout = time() + $TBAUTHTIMEOUT;
$query_result = mysql_db_query($TBDBNAME,
"UPDATE login set timeout='$timeout' ".
"WHERE uid=\"$uid\"");
if (! $query_result) {
$err = mysql_error();
TBERROR("Database Error updating login timeout for ".
"$uid: $err", 1);
}
return $CHECKLOGIN_LOGGEDIN;
}
elseif (!isset($curhash) || !$curhash || $curhash == NULL) {
#
# A login is valid, but we have no proof yet. Proof will be
# demanded later by whatever page wants it.
#
return $CHECKLOGIN_MAYBEVALID;
}
}
#
......@@ -111,7 +130,7 @@ function CHECKLOGIN($uid) {
TBERROR("Database Error deleting login info for $uid: $err\n", 1);
}
return -1;
return $CHECKLOGIN_TIMEDOUT;
}
#
......@@ -119,18 +138,23 @@ function CHECKLOGIN($uid) {
# message.
#
function LOGGEDINORDIE($uid) {
global $CHECKLOGIN_NOTLOGGEDIN, $CHECKLOGIN_LOGGEDIN;
global $CHECKLOGIN_TIMEDOUT, $CHECKLOGIN_MAYBEVALID;
$status = CHECKLOGIN($uid);
switch ($status) {
case 0:
USERERROR("You $uid do not appear to be logged in!", 1);
case $CHECKLOGIN_NOTLOGGEDIN:
USERERROR("You do not appear to be logged in!", 1);
break;
case 1:
case $CHECKLOGIN_LOGGEDIN:
return $uid;
break;
case -1:
case $CHECKLOGIN_TIMEDOUT:
USERERROR("Your login has timed out! Please log in again.", 1);
break;
case $CHECKLOGIN_MAYBEVALID:
USERERROR("Your login cannot be verified. Are cookies turned on?", 1);
break;
}
TBERROR("LOGGEDINORDIE failed mysteriously", 1);
}
......@@ -140,7 +164,7 @@ function LOGGEDINORDIE($uid) {
#
function DOLOGIN($uid, $password) {
global $TBDBNAME, $TBAUTHCOOKIE, $TBAUTHDOMAIN, $TBAUTHTIMEOUT;
global $TBNAMECOOKIE;
global $TBNAMECOOKIE, $TBSECURECOOKIES;