[CONFIRMED+FIX] Joomla! 1.0.13 Admin session dies for certain $task values

[lamoose]

I had a clean install of 1.0.8  (i.e. no add ons no patchs just the package from joomla) So I figured i'd upgrade to the latest version using the proper patch and I get these errors:


Warning: Missing argument 2 for mosMainFrame::initSessionAdmin(), called in /home/23958/domains/millwoodminiatures.com/html/administrator/index2.php on line 38 and defined in /home/23958/domains/millwoodminiatures.com/html/includes/joomla.php on line 742

Warning: session_start() [function.session-start]: Cannot send session cookie - headers already sent by (output started at /home/23958/domains/millwoodminiatures.com/html/includes/joomla.php:742) in /home/23958/domains/millwoodminiatures.com/html/includes/joomla.php on line 800

Warning: session_start() [function.session-start]: Cannot send session cache limiter - headers already sent (output started at /home/23958/domains/millwoodminiatures.com/html/includes/joomla.php:742) in /home/23958/domains/millwoodminiatures.com/html/includes/joomla.php on line 800

Warning: Unknown: Your script possibly relies on a session side-effect which existed until PHP 4.2.3. Please be advised that the session extension does not consider global variables as a source of data, unless register_globals is enabled. You can disable this functionality and this warning by setting session.bug_compat_42 or session.bug_compat_warn to off, respectively. in Unknown on line 0


I do not think 1.0.13 is a stable release. It is in operable. Maybe it should be pulled until there is a solution. Is there a solution?

[lamoose]

ok the hotfix seemed to work for me.

Cept now the errors and log out issue appears in the media manager iframe. Evertime you click a folder it logs you out.

[consigliere]

Hi guys,

I have been trying to duplicate the problem but I am unable to.  Can you guys tell me which web server software (Apache/IIS/etc) you experience this problem with and which version of that software and what PHP version you are using?  I am using Apache 2.2.x and PHP 5.2.3.

Rob

I am having the same problem,  Joomla Logs me out automatically when trying to open an item for editing. This is my enviroment:

Joomla 1.0.13
XhtmlSuite 1.8
Firefox 2.0.0.6
PHP 4.3.11
WebServerX  Apache 1.3.33 (Unix)

I read the error log of apache... Have the same previous warnings posted in this thread.

Code: Select all

[Fri Aug 10 19:42:15 2007] [error] PHP Warning:  session_start(): Cannot send session cache limiter - headers already sent (output started at /home/mazatlan/public_html/new/includes/joomla.php:794) in /home/mazatlan/public_html/new/includes/joomla.php on line 800
[Fri Aug 10 19:42:15 2007] [error] PHP Warning:  session_start(): Cannot send session cookie - headers already sent by (output started at /home/mazatlan/public_html/new/includes/joomla.php:794) in /home/mazatlan/public_html/new/includes/joomla.php on line 800
[Fri Aug 10 19:42:12 2007] [error] PHP Warning:  session_destroy(): Session object destruction failed in /home/mazatlan/public_html/new/includes/joomla.php on line 794

[RobS]

Hi all,

I'm sorry that I have taken so long to get back here but I have just been really busy and dealing with life.  I went through and tried to rework the problem so it doesn't have this problem and I think I found a way to deal with it that it is just as secure and possibly faster than the previous fix that was made.  I have attached a zip file to this post with two files in it.  The first file is index.php should replace administrator/index.php and joomla.php should replace includes/joomla.php  When you put these files in place, you will probably get logged out but once you get logged back in, the problem will hopefully be fixed.  Please do not test this on live sites though, I cannot guarantee that it works as I am working on a laptop and only have one environment to test against.

[jlleblanc]

Just gave it a shot on the box that was giving me trouble and it seems to be working so good so far. Thanks Rob!

[sgreen]

TVM for this - have just installed it on the system that was causing trouble and all appears to be well so far.  Nice!

StuG

[Rajah]

Thanks! It works now 

[baj45359]

Rob,
Now I know why they call you a Hero.  I'm fairly new to Joomla and muddle through maintaining 3 sites (1 for family and 2 for non-profits.)  Kind of just learn as I go.  I recently felt like I'd learned enough about Joomla to convert all three and just started my first major rework of a site.  This issue was presenting me with major problems and now all is well for me.  Thank you very much for your hard work on the project.
Bruce

Update PS - After the fix, when I moved from my laptop to my desktop, which is running Windows 2000 and IE v6.0, the problem remained.  I tried several reboots (which did not work) and a different browser on the same machine (which did work).  Then i deleted all my cookies, history, etc, and now it even works with the old IE version.

[edwardvdv]

Hi, I'd also like to report that I've tried both Soeren's one line patch and RobS his two file patch, and they both seem to work. Thank you guys!

I experienced problems with JoomFish logging me out every time I pressed Cancel or returned to the translations overview page.

FYI, config follows.

Config
Joomla 1.0.13 on CentOS 4.5/Apache 2.0.52/PHP 4.3.9
Joomla! Register Globals Emulation:  OFF 
Register Globals: OFF
Magic Quotes: ON
Safe Mode: OFF
File Uploads: ON
Session auto start: OFF

[soeren]

Hi Rob,

...I'm sorry that I have taken so long to get back here but I have just been really busy and dealing with life.  I went through and tried to rework the problem so it doesn't have this problem and I think I found a way to deal with it that it is just as secure and possibly faster than the previous fix that was made.

That solution works perfectly. It was really necessary that you modified the file joomla.php: the initAdminSession function really needed to be reverted back to what it was in Joomla! <= 1.0.12, thanks for that fix RobS. eXtplorer 2 and VirtueMart 1.1 (SVN) are working correctly now.

RobS' Fix works.

ciao, Sören

[treegarner]

Thank you, thank you, thank you....  I was creating autoresponders in Acajoom and was logged out after each new autoresponder.  With over 300 autoresponders to go, I was about ready to scratch the site and start over with 1.0.12.  You're a lifesaver!!

[akede]

Hi Rob,

I also like to confirm that the fix solved my issue. Very well done and many thanks

Alex

[amcvinni]

Awesome, thank you. the fix.zip files worked for me... I was starting to sweat.

Joo Roolz

[dagomar]

Yep, this fix seems to work for me too.
Just a thought... This bug will probably affect everybody who is upgrading (...). Not everybody is really good at finding hotfixes... So maybe it would be good to pull 1.0.13 or to upgrade asap (which ur probably working on but anyways...) keep up the good work!

[consigliere]

Yep, this fix seems to work for me too.
Just a thought... This bug will probably affect everybody who is upgrading (...). Not everybody is really good at finding hotfixes... So maybe it would be good to pull 1.0.13 or to upgrade asap (which ur probably working on but anyways...) keep up the good work!

You are right.

[rob27]

Just did a fresh install on FreeBSD 6.2PRE, Apache 2.2.4 & PHP 4.4.7
Session path is there and writable, exact config as previous 1.0.12 install.
Can login to frontend, cannot login to backend (kicked out immediately to blank page tried(IE6, IE7, FF2.0.5, Opera9.22 all the same)

Just applied the fix with the two files, and unfortunately doesn't do anyhting for me.

1.0.13 should not be named stable imho, I expect stable to stable for some reason.
Although one could argue that you can't really get much safer than without admin access :-)
Suggestion: at least a possible/know problems page should be set right where the downloads are.
Very glad I did not try to upgrade any live sites :-)

Will try to see if PHP5 makes any difference. One more night of fiddling, after that it's back to 1.0.12 for me. 

Additional info after many fiddling sessions :-) SOLVED FOR ME

What fixed it for me was NOT going back to 1.0.12, but going back to 1.0.12 gave me the same issue, even doing 1.0.11 + upgrade gave the same "session start" problems. So I was forced to look further down the line. Turns out this has been a recurring issue for many user from 1.0.8 thru to 1.0.12.

What fixed it for me was
- using MySQLAdmin to repair the database (looked like some DB corruption) using extensive, even if it was freshly created
- setting sef to 1 in configuration.php
- using .htaccess to set session path inside joomla dir (/joomla/sessions) (even if on my own server /tmp was definitely writeable)

My conclusion now would be that step 2 & 3 are not even necessary, will give it a try on a fresh one later on.

Hope this helps some people, it was driving me nuts  :P

And then the fix from RobS works perfectly. Yippee! Thanks man.

[fradav4]

Hi all,

I'm sorry that I have taken so long to get back here but I have just been really busy and dealing with life.  I went through and tried to rework the problem so it doesn't have this problem and I think I found a way to deal with it that it is just as secure and possibly faster than the previous fix that was made.  I have attached a zip file to this post with two files in it.  The first file is index.php should replace administrator/index.php and joomla.php should replace includes/joomla.php  When you put these files in place, you will probably get logged out but once you get logged back in, the problem will hopefully be fixed.  Please do not test this on live sites though, I cannot guarantee that it works as I am working on a laptop and only have one environment to test against.

Using IIS I had the same problem.  The patches fixed my issues.  Thanks!

[consigliere]

Hi guys,

I have been trying to duplicate the problem but I am unable to.  Can you guys tell me which web server software (Apache/IIS/etc) you experience this problem with and which version of that software and what PHP version you are using?  I am using Apache 2.2.x and PHP 5.2.3.

Rob

I am having the same problem,  Joomla Logs me out automatically when trying to open an item for editing. This is my enviroment:

Joomla 1.0.13
XhtmlSuite 1.8
Firefox 2.0.0.6
PHP 4.3.11
WebServerX  Apache 1.3.33 (Unix)

I read the error log of apache... Have the same previous warnings posted in this thread.

Code: Select all

[Fri Aug 10 19:42:15 2007] [error] PHP Warning:  session_start(): Cannot send session cache limiter - headers already sent (output started at /home/mazatlan/public_html/new/includes/joomla.php:794) in /home/mazatlan/public_html/new/includes/joomla.php on line 800
[Fri Aug 10 19:42:15 2007] [error] PHP Warning:  session_start(): Cannot send session cookie - headers already sent by (output started at /home/mazatlan/public_html/new/includes/joomla.php:794) in /home/mazatlan/public_html/new/includes/joomla.php on line 800
[Fri Aug 10 19:42:12 2007] [error] PHP Warning:  session_destroy(): Session object destruction failed in /home/mazatlan/public_html/new/includes/joomla.php on line 794

another error on my enviroment:

Code: Select all

Mon Aug 13 19:05:04 2007] [error] PHP Fatal error:  session_start(): Failed to initialize storage module: user (path: /tmp) in /home/mazatlan/public_html/new/administrator/index2.php on line 37

Is this for the same issue of this thread?

[Jesseh]

I did a quick test and it works so far, thank a lot RobS!!! 

[henrygud]

Hi,
I did a test after upgrade and it works, thanks!!! 
But why not update the 1.0.13 zip?

Thanks
Henry

[maeigr]

Upgraded joomla from 1.0.12 to 1.0.13.

I was able to login in the admin section, though, wherever I clicked I was logged out and got this message.

You need to login. If PHP's session.auto_start setting is on or session.use_cookies setting is off, you may need to correct this before you will be able to login.

I applied your fix and I was unable to login, and got this message instead:

Invalid Session

I tried a quick and dirty idea, by replacing administrator/index.php and includes/joomla.php by the 1.0.12 versions, though that didn't work (invalid password, they have already been salted apparently).

Perhaps the warning on the frontpage for the 1.0.13 version should mention that some user are unable to login as admin once the upgrade is complete :-/

Is there a possible downgrade path?

Edit: some info on the system :
Apache 2.0 mod_php5 mysql 4.1.22
PHP 5.2.3
session.use_cookies On
session.auto_start On
register_globals On
magic_quotes_gpc On 
safe_mode On 
file_uploads On

The front end login works without problems

Could it be the influence of fireboard?

HTTP_COOKIE PHPSESSID=some long hex number;
another hex number=another hex number;
webfxtab_modules-cpanel=4;
still an hex number;
yahn (yet another hex number);
fboard_settings[member_id]=0; fboard_settings[prevvisit]=10 digit number; fboard_settings[current_view]=flat

(not being perfectly sure of what those hex number are, I prefer not to show them  )

Edit2: The downgrade path: change back administrator/index.php and includes/joomla.php reset the admin password in the database: see http://forum.joomla.org/index.php/topic,10985.0.html

This allow you to login and work with your installation (though, you'll have to reset the password of other users who logged in)

Do not change your password using joomla interface

Replace the files changed by the 1.0.12->1.0.13 upgrade by the 1.0.12 files (you could directly do that, and reset the password, if you do not any reason to fiddle in the admin interface first).

Now you can change your password using joomla's interface (admin is a bit obvious for an admin password )

By the way, may I suggest a regenerate password+mass mailing feature for this kind of incident? (and a new howto for the reset of the password. With salt, the linked method won't work anymore, will it?)

[wilkinsonb]

the fix.zip worked for me but I had also previously replaced the index2.php file so maybe that is needed as well?

anyways, my site is working great right now.

[nrouze]

Fix worked perfectly for me on my site containing CB 1.1 and Joomfish 1.7

Thanks

Nicolas

[consigliere]

the fix.zip worked for me but I had also previously replaced the index2.php file so maybe that is needed as well?

anyways, my site is working great right now.

It is necessary to replace index2.php too?

[kenneta]

This fix made my day as well! Thank You very much. I was tired of logging in backend...
(Running on Linux-server)

Kind regards,

Kenneth

[Actor]

Unfortunately both proposed fixes didn't work here.
Still can't log into the admin panel: "Invalid Session" response.

running on PHP5.1.6, MySQL 5.0.46, Centos4.2

[RobS]

For the people that are getting the "Invalid Session" message, could you please try to clear your browser cookies or try a different browser if you have access to one.

Thanks.

[Actor]

Finally solved my problem.
It wasn't about the browser cookies, but after cleaning up every what has to do with session setting, except the RobS fix, I got it work. Especially cleaned up .htaccess. Just used the joomla default with one extra line: php_flag magic_quotes_gpc on
After that worked, I put back my session.save_path redirect to a private location outside the domain httproot. That also works now.

[choppy]

I just upgraded and applied the patch. Nothing works for me unfortunately. I don't have vituemart installed either. Nobody can login to our site at all now.

Admins can get in back end Hotfix just sent us to pages that didn't exist. 

Since I do not fully understant SEF (Never worked) I don't see the point in employing it.

Is the old version still available please? What with silence at Fireboard and an update that takes your site down its been a very interesting 48 hours. 

[consigliere]

Unfortunately both proposed fixes didn't work here.
Still can't log into the admin panel: "Invalid Session" response.

running on PHP5.1.6, MySQL 5.0.46, Centos4.2

I can login, but once in a while Joomla Logs me out with "Invalid Session Message".

No error logs. I am going to erase cookies and sessions to see what's happend.