[UNDER REVIEW] can't login to front-end after 1.0.13 to 1.0.14 upgrade

p_petrelli · Post by **p_petrelli** » Tue Mar 18, 2008 11:05 pm

Hm. Too bad.

Is there a way to test Jaz's theory? How about dumping both your working .15 and the botched .14 database and running a diff?

jaz · Post by **jaz** » Wed Mar 19, 2008 5:45 am

I can't seem to find a 1.0.14 Full/Stable bundle on my systems -- and it's not listed in the downloads.

Hmmm, this is weird -- I wouldn't have deleted it from my local collection,... and I was so sure I'm wasn't lying about the chain of events on my broken site. Maaaaybe I first installed onto 1.013, had the login problem, applied one or more of the session fixes, then upgraded to 1.0.14 (still didn't work), then upgraded to 1.0.15 (still didn't work).

Were there any DB changes in the 13->14 or 14->15 patches??

Ok, so I took the two sites and reversed their db's and file trees.... In configuration.php pointed to other db and changed $mosConfig_live_site, and in Apache pointed the ports to the opposite file tree folders (directory).

Site-1 Originally either 1.0.13 (?session patches?) or 1.0.14, first clobbered with 14->15 upgrade, then clobbered with 1.0.15 Full (Not able to login)

Site-2 Native 1.0.15 (Yes, can login)

Before:
Site h++p://localhost:3001 -- Running out of Folder 1, connected to DB-1, and being served up by Apache on Port-3001
Site h++P://localhost:3002 -- Running out of Folder 2, connected to DB-2, and being served up by Apache on Port-3002

After:
Site h++p://localhost:3001 -- Running out of Folder 2, connected to DB-1, and being served up by Apache on Port-3001
Site h++P://localhost:3002 -- Running out of Folder 1, connected to DB-2, and being served up by Apache on Port-3002

Result:
---> Site-1 (Folder-2, DB-1) -- NOT able to login (same)
---> Site-2 (Folder-1, DB-2) -- YES able to login (same)

Reversed the changes and no surprises. (I didn't actually login to site-2, as these two sites are in development and I didn't want to risk messing up the working one; I'd mirror them but since the broken site is now running on 1.0.15 file tree, I doubt the login will fail). Note, I was reporting an error "You are not authorised to view this resource. You need to login."

So, does this support the idea that it's in the DB rather than a file somewhere? (Am I correct in recalling that most of the session fixes around 1.013 were replacement files and prescribed file edits? Were there any DB edit in there?). Perhaps one of the earlier files, say that deals with sessions, saved a hash or something in a DB field and that's not giving with whatever the later version(s) of the same routine expects/wants. ??

p_petrelli · Post by **p_petrelli** » Wed Mar 19, 2008 10:55 am

So, does this support the idea that it's in the DB rather than a file somewhere? (Am I correct in recalling that most of the session fixes around 1.013 were replacement files and prescribed edits?). Perhaps one of the earlier files, say that deals with sessions, saved a hash or something in a DB field and that's not giving with whatever the later version(s) of the same routine expects/wants. ??

Yes, I'd say so. Thanks for investigating, I sure hope this leads somewhere...

Norguad · Post by **Norguad** » Tue Mar 25, 2008 2:25 pm

Please, does anybody already know, how to solve this problem???

amorosso · Post by **amorosso** » Wed Mar 26, 2008 12:51 am

PLEASE PLEASE PLEASE PLEASE. this bug or what ever is killing me. My ad in Better homes and garden just hit the news stands.. I do notice that it is only with IE and not all the time, it's like it's on a clock or something.

jaz · Post by **jaz** » Wed Mar 26, 2008 1:11 am

This is interesting -- as I tested above, my version of this problem is in the database. Mine is with any browser, and at any time. It's clear to me that amorosso and I are seeing different bugs.

@amorosso -- Do you get a login field? (I just get "you are not authorised to view this page")

amorosso · Post by **amorosso** » Wed Mar 26, 2008 2:45 am

See heres the strange thing. I use oprea most of the time and everything works in these browser. I have no issues what so ever in oprea, firefox and safari. But now in IE and only at certin times. Before posting this I was able to log in with IE and the time was 10:31 pm. And I wasn't for a few hours before hand. So what I'm coming up with is that it's on a clock. My wife is a DB programmer for IBM and if I can point her in the right direction of which db file to look at I think she could help us all. So could someone tell me what files to start looking at.

regards... Dominick

rebelojose · Post by **rebelojose** » Mon Mar 31, 2008 12:28 am

Hi,
in frontend i can login in firefox and safari , but with internet explorer i cannot
but if in IE i check box "remember password" i login without problems, so...
i 've redirect link created in CPANEL on HOST, but my host make upgrades recently, so i remember delete the old redirect link and create a new one with same redirect link, so know I CAN LOGIN INTERNET EXPLORER

my preferred browser it is of course firefox, but i 've most users use IE
tks for support
maybe i can help someone with this problem

best regards
jose rebelo

dvnitycker · Post by **dvnitycker** » Tue Apr 08, 2008 9:00 pm

updated from 1.0.12 -> 1.0.15, using Joomla-SMF Login module, CB is 1.1, users cannot login - it just returns them to main page, without login... solution?

amorosso · Post by **amorosso** » Tue Apr 08, 2008 9:21 pm

You know what is funny, ever since and I mean ever since I posted my last post here I havent had any issues. Oh great now I will. LOL

p_petrelli · Post by **p_petrelli** » Wed Apr 09, 2008 4:42 pm

Lucky you, amorosso.

For those of us not so lucky, will there ever be a real REVIEW of this catastrophic bug? Dare I say SOLUTION?

amorosso · Post by **amorosso** » Wed Apr 09, 2008 5:01 pm

I'm sure mine is only short lived for the moment at least. I just dont know wht is causing this. I can tell you and everyone here, as I think I did before I did change my server time settings and it's been fine ever since. I just don't know if that was my fix or not.

Norguad · Post by **Norguad** » Thu Apr 10, 2008 5:18 am

I am still looking forward to the solution, I need the front-end registration...

dvnitycker · Post by **dvnitycker** » Thu Apr 10, 2008 9:37 am

I haven't found the solution. Instead, I changed login module. I was using Joomla-SMF Login and am now I'm using CB module... it works, but that's not a solution but a compromise

p_petrelli · Post by **p_petrelli** » Sat May 10, 2008 7:47 pm

So... a month has gone by after the last post on this thread. Might I inquire about the status of this bug's Review?

Norguad · Post by **Norguad** » Sat May 10, 2008 10:24 pm

Solution for me: stay on 1.0.13...

sural98 · Post by **sural98** » Thu May 22, 2008 2:59 pm

masterchief wrote:Can anyone experiencing problems turn their Error Reporting setting in Global Configuration to Maximum and see if an error is generated. If you can't login, the manually change the configuration.php, change the setting:
$mosConfig_error_reporting = 2047;
Try to log in. See if you get an error - then change it back to what it was.

Joomla 1.0.13 upgrade to Joomla 1.0.15 with utf-8 language files and $mosConfig_error_reporting = 2047;
MySQL 4.1.x UTF-8 Joomla DB
I suspect the problem is utf-8 language file related.
Because when I use utf-8 language files under /language directory the browser outputs the following error a few seconds and returns back to Joomla admin page with 'Invalid session' error.

Code: Select all

Warning: session_start(function.session-start) Cannot send session cookie - headers already sent by (output started at /Joomla/site/path/language/english.php:1) in /Joomla/site/path/administrator/index2.php on line 37
Warning: session_start(function.session-start) Cannot send session cache limiter - headers already sent by (output started at /Joomla/site/path/language/english.php:1) in /Joomla/site/path/administrator/index2.php on line 37

If I use regular language file I am able to login to the backend.

What is the problem with utf-8 language file?

2ndmouse · Post by **2ndmouse** » Fri Jun 06, 2008 12:45 pm

[quote]
Re: [UNDER REVIEW] can't login to front-end after 1.0.13 to 1.0.
by boofka_99 on Tue Mar 18, 2008 1:01 am

p_petrelli, I am indeed seeing the $my variable getting unset due to the situation I described earlier. When I changed the $mosConfig_live_site in the configuration.php file back to not having the "www", the $my variable shows to be unset because of the htaccess redirection to http://www.yourdomain.com.
[quote]

I'm not using .htaccess file. However, this suggestion has fixed my front end login problem. Slightly different situation - i removed the www. from $mosConfig_live_site and all is well. Really weird though - the frontend login has been perfectly fine since i launched the site back in February, then out of the blue, it stopped working today. I've not made any changes recently.

Anyway, thanks for the solution chaps

nmbsailorgirl · Post by **nmbsailorgirl** » Thu Jun 19, 2008 12:51 pm

We have determined that the problem is related to a recent Windows update and not Joomla. We're looking into how Joomla sets the cookie and what might have changed with Windows Security. The 'Remember Me' option seems to work, so whatever is different about that setting seems to resolve it.

Hope this information is helpful!

p_petrelli · Post by **p_petrelli** » Mon Jun 23, 2008 7:55 am

nmbsailorgirl wrote:Hope this information is helpful!

Much more so if you could you elaborate on that...
In particular, which specific Windows update (KB number) are you referring to?

nmbsailorgirl · Post by **nmbsailorgirl** » Mon Jun 23, 2008 8:27 pm

Well that would help, wouldn't it. Unfortunately, we aren't sure, which is why we said "we think". I'm still trying to track down if it is related to a cookie issue/security update and if I track it down, I will let the forum know!

p_petrelli · Post by **p_petrelli** » Mon Jun 23, 2008 9:17 pm

nmbsailorgirl wrote: Well that would help, wouldn't it.

Immensely. :-)

which is why we said "we think".

You said you "have determined". That sounded a lot more confident...

But even if you're not sure, why won't you let people help you investigate by telling them where you suspect its worthwhile to look?

lebill · Post by **lebill** » Thu Jun 26, 2008 9:19 pm

Hi,

I have the same problem, cannot login from the front end,

after some debugging, I found in the /include/joomla.php

Line 6056, my error message is trigger there, if I remove the spoofing attack validation, everything came back to normal.

Very weird,

anyway I know if the validation is there it's for a reason, but I don't have any more time to continue debugging.

If someone found the reason , please post it in this tread.

Thanks

robin.mousley · Post by **robin.mousley** » Sun Jul 06, 2008 6:47 am

We're having the same issue with 1.0.15. We missed 1.0.14 - and upgraded from 1.0.13

Here's a twist:

My partner and I can both login to the front end from our computers at work; but neither of us can login from our computers at home.

Our site is dying - we rely on user generated content and most of our users cannot login. We need help.

lebill · Post by **lebill** » Sun Jul 06, 2008 2:07 pm

Hi,

Do like me open the /include/joomla.php

Go to line 6056

Look around this line and you see

// probably a spoofing attack
if (!$validate) {
header( 'HTTP/1.0 403 Forbidden' );
mosErrorAlert( _NOT_AUTH );
return;
}

Just put comment (/* */)
around those 5 lines of code

It fix my problem for good, but I still don't know why

Hope someone from Joomla will have a answer soon.

robin.mousley · Post by **robin.mousley** » Tue Jul 08, 2008 6:51 am

Removing the spoofing attack validation doesn't help for us.

To reiterate:
The problems started when we updated from 1.0.13 to 1.0.15.
Some of our users are able to login no problem.
Both my partner and I can login in from our office computers, no problem. Neither of us can login from home. The home page of the site simply reloads with the login fields cleared. We both tried both IE and Firefox - same behavior with both.

robin.mousley · Post by **robin.mousley** » Tue Jul 08, 2008 7:13 am

More information:

I can connect my laptop to the Internet in three ways: via wireless to my home network; via wireless to our corporate network and via 3G/mobile network.

When I connect via the home network - I have the login problem.
When I connect via the corporate network - I can login no problem.
When I connect via the 3G mobile network - I can login no problem.

So: all things remain the same - computer, browser, everything. The ONLY difference is the path to the Internet.

Surely someone must be able to suggest a solution or next step on the basis of this information?

Thanks
Rob

robin.mousley · Post by **robin.mousley** » Wed Jul 09, 2008 5:16 pm

Site: www.surfski.info
Problem: Can't login (from home over adsl): home page just refreshes without any apparent error message.

I installed firebug on firefox 3 and I can see what appears to be a response to the login request. Does this mean anything? Anyone?

<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN">
<html><head>
<title>406 Not Acceptable</title>
</head><body>
<h1>Not Acceptable</h1>
<p>An appropriate representation of the requested resource /component/option,com_comprofiler/task,login/ could not be found on this server.</p>
<hr>
<address>Apache/2.0.63 (Unix) mod_ssl/2.0.63 OpenSSL/0.9.8b mod_auth_passthrough/2.1 mod_bwlimited/1.4 Server at www.surfski.info Port 80</address>
</body></html>

jrtalon · Post by **jrtalon** » Fri Jul 11, 2008 12:57 am

Hi, I'm having the same problem. If I turn off Search Engine Friendly URLs in the global config I can log on through front-end but when its ON and I try to login I just get back to the front page without being logged in.

I did have sh404sef and artio sef installed (not at the same time). Also I'm running joomseo.

Now the thing I noticed is if I disable Search Friendly URLs, clear my browser, then re-enable Search Friendly URLs. I can login, however, if I logout and then try to log back in I'm not able too anymore....even if I clear my browser history again.

Does Artio SEF or sh404sef make any changes to the database or core files that would cause this? I went into phpmyadmin and dropped the tables I found associated with sh404sef.

EDIT: I just did a clean install of .15...same problem, I can't believe this problem has been going on since MARCH with no solution!! Why do you even have .15 up still...it should be pulled as user login and SEF are very very important when running a website, WE SHOULDN'T HAVE TO CHOOSE!

jrtalon · Post by **jrtalon** » Fri Jul 11, 2008 6:38 am

I just installed a FRESH 1.0.13 in another folder on the same server....and I cannot login to the front end with SEO: Search Friendly URL's enable. It must be a server thing which would explain why some people can login and some people can't.

To the people having this same issue what hosting company are you with? I'm using lunarpages.com