The Problem
I'm having some serious troubles with access to the back end of the site!
Not only do I have trouble logging in as administrator, but I can't stay logged in all the time.
I've stumbled into a workaround by playing with the suggestions in this post. I inserted a die() command with some information in administrator/components/com_login/admin.login.php. When the login fails (as it always does) I get my error message. Then I hit "back" on my browser and I am in the admin area--all logged in!
I got the "invalid token" message once. It was a strange sequence and I'm not sure I can reproduce it at will.
if (!JError::isError($result)) {
// MXM: trying to solve admin login problem.
echo 'Login failed that time.
administrator/components/com_login/admin.login.php';
echo '
';
die('No joy.');
$mainframe->redirect('index.php');
}
I upgraded from 1.5.14 to 1.5.15 early on the morning of Saturday, 12 Dec 2009.
I don't know whether the problem is because of the upgrade or because of other changes we've made in httpd.conf to raise the security of the site. I can't roll back those changes because they are necessary for certification.
This is not an entirely uncommon symptom, but it can have a lot of different causes.
Pasta faggiole!
It has something to do with session cookies, I think. I get a cookie from the login routine, but then some cookie-checking part of the admin component gets the cookies mixed up. It seems to trash the good cookie and replace it with one that doesn't measure up--and I get kicked back out to the login screen.
This used to happen with Joomla 1.
I may need to tweak something in php.ini--but I haven't figured out what.
Not all administrator functions cause me to be kicked out. Just some. Editing this article and saving or applying it causes me to lose my logged-in status. Things that haven't worked:
- Turned on the Joomla authentication plugin.
- Used the new htaccess.txt as .htaccess.
- Set var $live_site = 'http://tighar.org/news'; in configuration.php.
- Used different browsers.
- Neat error message redirector. It's a big help in picking up some clues that may eventually prove helpful.
- Cleared cookies from Firefox.
- Cleared sessions from database.
- Cleared caches from Joomla.
- Logged in as a different user on a different machine (from Windows Vista to Macintosh).
- Enabed the authentication module for jos_plugins (Authentication - Joomla published = 1).
- Enabled the Joomla user module (published = 1).
- Enabled jfusion system--that locked me out of being able to edit this article from the front end!
- Commented out JRequest::checkToken('request') or jexit( 'Invalid Token' );
- session.auto_start = 0 in php.ini
- Checked access control maps in the database.
- Played with session lifetime variable in configuration.
- Reset administrator passwords. The new password worked, but it didn't solve the kickout problem.
- Updated JFusion; followed all upgrade steps. Login checker is all green.
- Disabled the JFusion plugins.
- Turned off all SEF/SEO in the back end
- Changed .htaccess by uncommenting "RewriteBase" and setting it to /news
- Renamed .htaccess to htaccess
- Changed "Force SSL" from "Administrator only" to "none"--then got "Username and Password do not match"!
That was frightening!
- Installed all 1.5.15 files again--from fresh download.
- Enabled legacy mode.
- Verified that session.save_path is 777.
- Played with session.save_path mode.
- Inserted ini_set('session.save_path',"/path/to/php/session"); into configuration.php
- Changed session handler from database to Apc to none and back to database.
- Made admin cache unwriteable.
It may be an SEF/SEO/rewrite problem. The buttons that invariably cause the problem in the back end:
The links from those buttons all have the same form:
https://tighar.org/news/administrator/index.php?option=com_config#
Which then throws me back here:
https://tighar.org/news/administrator/index.php
Speculation: I think that the site is trying up to update the timer in my admin session, fails to find it, then expels me from the back end. Meanwhile, another part of the system sees me as still logged in!
Diagnostic information
Relevant components
- Community Builder
- JFusion
Diagnostic Information
Joomla! Version: Joomla! 1.5.15 Stable [ Wojmamni Ama Mamni ] 05-November-2009 04:00 GMT
configuration.php: Writable (Mode: 775 ) | RG_EMULATION: N/A
Architecture/Platform: Linux 2.6.24-19-xen ( x86_64) | Web Server: Apache/2.2.9 (Fedora) ( tighar.org ) | PHP Version: 5.2.9
PHP Requirements: register_globals: Disabled | magic_quotes_gpc: Disabled | safe_mode: Disabled | MySQL Support: Yes | XML Support: Yes | zlib Support: Yes
mbstring Support (1.5): Yes | iconv Support (1.5): Yes | save.session_path: Writable | Max.Execution Time: 30 seconds | File Uploads: Enabled
MySQL Version: ( )
Extended Information:
SEF: Enabled (with ReWrite) | FTP Layer: Disabled | htaccess: Implemented
PHP/suExec: User and Web Server accounts are not the same. (PHP/suExec probably not installed)
PHP Environment: API: apache2handler | MySQLi: Yes | Max. Memory: 64M | Max. Upload Size: 6M | Max. Post Size: 8M | Max. Input Time: 60 | Zend Version: 2.2.0
Disabled Functions:
MySQL Client: 5.0.77 ( )
Not tried:
Weird, interesting variation:
- In php.ini, I set session.cookie_domain = '.tighar.org' and restarted httpd. This helped with getting thrown out of the back end--I could then use the save, apply, and cancel buttons while I was logged in through my kludge. But when I logged out, there were two new errors: the kludge no longer worked and I got a cURL error in the front end (500--internal server error). This shows that cookie tracking may be THE problem.
Half a solution is better than none
I have improved my kludge. This allows me to go straight into the administration area without first stopping at my failure page. The fact that a session cookie is issued and that this stupid thing works suggests that SEF/SEO may be at least part of the problem.
if (!JError::isError($result)) {
// added next line
$mainframe->redirect();
// MXM: The original kludge--trying to solve admin login problem.
echo 'Login failed that time.
administrator/components/com_login/admin.login.php';
echo '
';
die('
There is no joy in Mudville...');
$mainframe->redirect('index.php');
It is not that my credentials are rejected
I turned on logging, tried a fake username and password, and got this message in the logs: "FAILURE: User does not exist." But no errors are logged for the times that I use my correct credentials. I am validated and have an active session even though the $result says that there has been an error in the login.
The Silver Bullet?
In Site/Global Configuration, I changed "Force SSL" from "Administrator only" to "whole site." I was able Save, Apply, and Cancel in the back end. But it didn't last! After going to another site to report success, I came back to return my admin module to its original form. Before I could do so, I found out that THE BUG WAS BACK!
Somewhat tarnished!
- The html function doesn't work in TinyMCE! Drat. It's broken both in the front end and in the back end.
- Joomla's time is waaaaaaaaaaaaaay off. The error log for when I tried "Force SSL" seems to be operating on GMC, even though I have -5:00 set in the Global Configuration:
2009-12-14 01:53:42 - 138.92.15.142 FAILURE: Invalid password
2009-12-14 01:54:40 - 138.92.15.142 FAILURE: Invalid password
- I couldn't stay logged in in the front end!
- Started generating nag messages about sending insecure information to the website.
Gerry-rigging the JURI
Hacking a core component seems to be what I needed. I'm editing this from the back end. I've logged in and out. The HTML button works in the editor. So far, so good!
Links
Billable Hours
In the neighborhood of 20 hours from Saturday AM to Monday AM. I didn't keep a strict log. At my hourly rate of $0.00 per hour, it doesn't much matter. But it was a long slog!
