Joomla! Discussion Forums

I have searched and been unable to find a solution.

I have a site with a hand full of users....when I go to the site I sometimes see the most recent user session on the login screen...this allows me access to secured parts of the site..but after a couple of clicks it does eventually ask to enter a proper id and password.

Question is how come the sessions are living between 2 different users on 2 different computers.

I've seen the same problem too and can't find an answer. This is worrying and I need to find a solution pretty soon.

I had this as well, the next day, I got an email from Joomla explaining to me I need to update. I saw what the security risk was, and it almost 100% explained how they might have managed to hack my site.

A few days ago, I tried to log in, wrong password. In MySQL I saw that my password hashes differed from another account I had, with the same password. I override the password hash with my other account's hash, and then could log in. Clearly the user must have hacked it the same way last time. Thank goodness nothing was lost, but this hacker will strike again.

Joomla must fix this ASAP, or else a lot of users will be looking at another CMS. P.S. My site is now offline, and I'm reviewing CMS's till Joomla can fix this.

It was actually fixed over 2 weeks ago... You just decided not to look and to point fingers...

sorry ircmaxell; can you point me to the link on how to fix this

much appreciated

Just to point out that this is with 1.5.6....

Are you running Community Builder?

I'm running 1.5.6 (Latest) - and this still happend... Even though I've updated!

Yes I am....should I follow up on their forum?

* JCal Pro
* J! v1.5.6
* PHP 5.2.3
* MySQL 5
* JCal theme - default
* J! English
* CB 1.2 RC 2

I'm using CB 1.2 RC2

Would a webaddress/login be helpful? I could PM....

I've installed community builder with the hopes to not have any funny stuff happening to my admin account out of nowhere anymore...

PLEASE retest WITHOUT CB... It sounds like it's time for a security audit of it (this is not the first time I've heard "something" like this happening with CB installed)... I'll get back to you in a day or 3...

I never had CB installed when this happend

FYI, CB 1.2 beta 6 went through a full source code security audit, and only one extremely minor item got reported and fixed for CB 1.2 RC 1.

CB's security track compares quite well with other web-software and extensions these days, especially given the scope and size of CB.

Only reported issues today are in very old versions, and we currently don't know of any confirmed open security issue, while always spending lots of time to analyze security issues around CB.

Last few problems we saw with such a thing was due to a damaged joomla install, or a Joomla 1.5 install before 1.5.6. Reinstalling joomla and cb solved the issue.

I'm not saying that everything is 100% secure, but that we are taking security very seriously, and are very open to improve it further, and looking forward to your security audit of latest CB 1.2 RC 2

Hello all,

I just registered an account specifically due to this problem. I'm running a fresh install of 1.5.6 and having the same issue. I will log in with my admin account and at times after a few minutes my login greeting will change to that of some other user. I'm then able to poke around the site as that user without challenge. My concern is that some random user might end up with my admin rights and cause some problems. Just started happening a few hours ago, have had the site up and running for about 4 days now. I'm not running CB, but I do have FireBoard installed (latest stable version), as well as a bridge for my G2 gallery.

It's possible this is caused by either of those two addons...but if so, why did it wait to start a few hours ago when the site has been getting consistent traffic since day one?

Are you also sure it is not a server side, perhaps caching issue?

Ok... I've built a POC script which SHOULD have caused this (session collisions) if it was a core issue. After over 1 million requests, with over 25,000 sessions, not a single collision... To me, it looks pretty likely that it's not a core issue... Please try removing all bridges and remove CB, and retest. If anyone can get it to consistently happen on their server (WITHOUT any 3pd extensions), please PM me...

Cool that you wrote a POC for this





Looks like CB is not involved in this problem.

I have also reviewed the code for JFactory:GetUser() which is used to get the logged-in user in Joomla 1.5.6, and unless there is a problems with your PHP sessions, I don't think that there is a problem.

Now maybe another track:

1) which sessions handler do you have set in the backend global configuration of joomla ?
2) if you change the sessions handler, does the problem persist ?

...would it have to do with the cache?
I am running my site on IIS 5 on a W2K server.

Was the test done using Apache?


ultimately ...there is a problem because it happening with more then one site..

Well.... The test was not using Apache, it was done using LIGHTTPD... BUT, the server doesn't make a difference. What would, is the SAPI... What SAPI (Server API: CGI, FastCGI, mod_php, etc) are you using? What version of PHP? Could you provide a phpinfo page? Also, what session storage are you using? What 3pd extensions (PLUGINS and COMPONENTS)...

Besides, IIS is not "officially" supported at this time. Please see http://help.joomla.org/content/view/1938/310/ the minimum requirements...

Here's my configuration

* JCal Pro
* J! v1.5.6
* PHP 5.2.3
* MySQL 5
* J! English
* CB 1.2 RC 2

Here's the phpinfo link for my site ---> http://www.hockeyhost.ca/atom/phpinfo.php



Just in the process of switching over to Apache.

here's my session storage settings.

Befdore you switch over, could you please try the other session settings, so we have one variable changing at a time ?

Thanks

Hm, Joomla still recommending PHP 4.4.7 ?

PHP 4.x officially doesn't have any security releases anymore since 08.08.08... Maybe time to recommend PHP 5.2, and actually PHP 5.2.6, as some of the releases between 5.2.0 and 5.2.5 included, if not security-patched, had serious security vulnerabilities ?

I just finished getting everything working in Apache....

but the switch over is easy enough.

Back to unsupported IIS

I also tested the session storage as DATABASE...and the frequency of the "login page a different user error" occurred more often...

Please install a fresh install of 1.5 on that server (NO EXTENSIONS), and test it there...

Sure...can you point your POC script to my site....BUT throttle the hits down a fraction or 2?

PM me please?

Hello gentlemen,

Just wanted to thank you for your replies and give you an update on my situation...

As previously stated this appears to be a cache related issue. With my G2 bridge, all was well until another admin went crazy on caching and turned on both the G2 session cache and the Joomla cache. Looks like the session cookies were getting confused by the same domain handing out conflicting credentials (or session timeouts). I initially turned off all caching by setting the G2 to "no acceleration" and disabling the system cache module in Joomla. Ran it for a day, and no more burps. As I have buttloads of images in my G2 gallery, I enabled partial acceleration. Ran fine for a bit, at least until the session cookies there started expiring and them back to the same problem.

I eventually ended up turning off all internal application caching inside of Joomla and G2, and installed a PHP accelerator. Now the site is much, much faster (by a magnitude of 10 :-) ), and no more login / session errors.

Hope this helps someone out there...

Regards,
Brian

Just to be clear here...cache related issues when using the G2 connector. Never had a problem with straight Joomla install, so core is fine from what I can see and verify....

Well..I've been running a base install of 1.5.6 and haven not been able to reproduce the problem.

Remembering my original configuration

* JCal Pro
* J! v1.5.6
* PHP 5.2.3
* MySQL 5
* JCal theme - default
* J! English
* CB 1.2 RC 2

I will now install CB 1.2RC and will continue to test.