View Issue Details

IDProjectCategoryView StatusLast Update
5888Composrcorepublic2024-10-12 18:48
ReporterAdam Edington Assigned ToPDStig  
PrioritynormalSeveritymajor 
Status closedResolutionnot fixable 
Product Version10.0.49 
Fixed in Version10.0.50 
Summary5888: Login loop when accessing CMS/Admin zones
DescriptionWhen trying to edit content in the CMS zone or access Admin CP I am getting stuck on the login screen (Your login must be confirmed before you may enter this high-security area (you do not currently have a confirmed session)), despite being logged in as admin.
TagsNo tags attached.
Attach Tags
Attached Files
Time estimation (hours)
Sponsorship open

Sponsor

Date Added Member Amount Sponsored

Relationships

related to 5887 ResolvedPDStig Session cookies should always be HttpOnly / Secure where applicable 

Activities

Adam Edington

2024-08-14 12:16

administrator   ~9183

Last edited: 2024-08-14 12:29

Actually just logged out, thinking relogging in might solve this. Now I cannot login.
EDIT: Backdoor IP Is the workaround, at least I can carry on adding content ;)

PDStig

2024-08-14 15:11

administrator   ~9184

Try clearing your browser's cookies. I had to make a change in how Composr handles cookies so Composr might be getting stuck in a loop as you have the old cookie.

Adam Edington

2024-08-14 16:58

administrator   ~9186

Yes that works, thanks.

admin

2024-08-14 18:22

administrator   ~9189

Automated response: Login loop when accessing CMS/Admin zones

The release of 10.0.49 may cause a login loop if old insecure cookies exist along with the new secure cookies.

While this patch does not specifically address this issue (the remedy is to clear your browser cookies), this patch adds additional improvements to cookie handling including trying to clean out old cookies when setting new ones. This was semi-ported from v11.

Therefore, this patch *might* take care of the problem in the event cookies are not cleared, but I haven't tested for certain.

admin

2024-08-14 18:22

administrator   ~9190

Fixed in git commit 68d838de67 (https://gitlab.com/composr-foundation/composr/commit/68d838de67 - link will become active once code pushed to GitLab)

A hotfix (a TAR of files to upload) has been uploaded to this issue. These files are made to the latest intra-version state (i.e. may roll in earlier fixes too if made to the same files) - so only upload files newer than what you have already. If there are files in a hot-fix that you don't have then they probably relate to addons that you don't have installed and should be skipped. Always take backups of files you are replacing or keep a copy of the manual installer for your version, and only apply fixes you need. These hotfixes are not necessarily reliable or well supported. Not sure how to extract TAR files to your Windows computer? Try 7-zip (http://www.7-zip.org/).

Bitmain

2024-08-15 12:03

reporter   ~9198

I tried the hotfix. Uploaded both files from hotfix, manually.
No changes, stil a loop problem with loging.

After I am logged, prepare a News. No way to add an Image (that's another bug, it worked super fine till yesterday).
After I want to publish a News, I am kicked out as an admin, recognized by composr as a Guest, and need to relogin myself.

PDStig

2024-08-15 12:15

administrator   ~9199

@Bitmain Does clearing your browser cookies, or renaming the name of the session cookies in _config.php, work?

Bitmain

2024-08-15 16:13

reporter   ~9201

@Patrick Browser clearing is not working. Tried several times, same problem.
About cookies - those are the paths I have:
$SITE_INFO['cookie_domain'] = '';
$SITE_INFO['cookie_path'] = '/';
$SITE_INFO['cookie_days'] = '120';

Should I tried to change _path to '/cookie' ?

Thank you!

Bitmain

2024-08-15 16:21

reporter   ~9202

Changed the cookie path, error:
Composr_cookie error.JPG (15,141 bytes)   
Composr_cookie error.JPG (15,141 bytes)   

PDStig

2024-08-15 17:58

administrator   ~9203

No, the path should be left at / .

Do you have $SITE_INFO['session_cookie']? Try changing the name of that. If it has a hash (random letters and numbers at the end), try changing those.

I suspect however if clearing browser cookies did not work then this won't work either but worth a shot.

Bitmain

2024-08-16 17:21

reporter   ~9204

Those are all what I have (probably default ones):

<?php
global $SITE_INFO;
$SITE_INFO['default_lang']
$SITE_INFO['db_type']
$SITE_INFO['forum_type']
$SITE_INFO['domain']
$SITE_INFO['base_url']
$SITE_INFO['table_prefix']
$SITE_INFO['master_password']
$SITE_INFO['use_persistent']
$SITE_INFO['db_site']
$SITE_INFO['db_site_host']
$SITE_INFO['db_site_user']
$SITE_INFO['db_site_password']
$SITE_INFO['user_cookie']
$SITE_INFO['pass_cookie']
$SITE_INFO['cookie_domain']
$SITE_INFO['cookie_path']
$SITE_INFO['cookie_days']
$SITE_INFO['db_forums']
$SITE_INFO['db_forums_host']
$SITE_INFO['db_forums_user']
$SITE_INFO['db_forums_password']
$SITE_INFO['cns_table_prefix']
$SITE_INFO['self_learning_cache']
$SITE_INFO['multi_lang_content']

PDStig

2024-08-16 17:26

administrator   ~9205

Last edited: 2024-08-16 17:27

Okay, in that case, add this to the bottom:

$SITE_INFO['session_cookie'] = 'cms_session__somerandomnumbersandletters';

Of course change somerandomnumbersandletters.

Bitmain

2024-08-16 18:05

reporter   ~9206

Hi, It is the same. I added line you mentioned, no changes.

I also checked cookie setting, and I have in Chrome "Allow third-party cookies".

I also tested to add an Image to the News, nope. Image is not added. If I press Save, Im kicked out as Site Admin, and need to enter the password again.
Composr_Admin Logn Loop.JPG (39,488 bytes)   
Composr_Admin Logn Loop.JPG (39,488 bytes)   

Adam Edington

2024-08-16 21:44

administrator   ~9207

Last edited: 2024-08-17 00:57

This won't fix the issues mentioned in this thread, but if you need to work on your website as the main admin account you can add:-
$SITE_INFO['backdoor_ip'] = 'your_current_ip';
to the bottom of your _config.php

You can get your current IP via https://www.myip.com/

Of course if your IP changes you will be logged out, but this should at least let you maintain a logged in state.

PDStig

2024-08-18 01:02

administrator   ~9236

REVERTED in 10.0.50

Issue History

Date Modified Username Field Change
2024-08-14 12:02 Guest New Issue
2024-08-14 12:02 Guest Note Added: 0009182
2024-08-14 12:07 Adam Edington Reporter Guest => user4160
2024-08-14 12:07 Adam Edington Severity Trivial Bug => Major Bug
2024-08-14 12:07 Adam Edington Description Updated
2024-08-14 12:08 Adam Edington Description Updated
2024-08-14 12:10 Adam Edington Description Updated
2024-08-14 12:10 Adam Edington Assigned To => user4172
2024-08-14 12:10 Adam Edington Status Not Assigned => Assigned
2024-08-14 12:13 Adam Edington Summary Login loop when accessing CMS zone => Login loop when accessing CMS/Admin zone
2024-08-14 12:13 Adam Edington Description Updated
2024-08-14 12:13 Adam Edington Summary Login loop when accessing CMS/Admin zone => Login loop when accessing CMS/Admin zones
2024-08-14 12:13 Adam Edington Description Updated
2024-08-14 12:16 Adam Edington Note Added: 0009183
2024-08-14 12:29 Adam Edington Note Edited: 0009183
2024-08-14 15:11 PDStig Note Added: 0009184
2024-08-14 16:58 Adam Edington Note Added: 0009186
2024-08-14 18:47 PDStig Relationship added related to 5887
2024-08-15 12:03 Bitmain File Added: Composr_error uploading picture or Add News.JPG
2024-08-15 12:03 Bitmain Note Added: 0009198
2024-08-15 12:15 PDStig Note Added: 0009199
2024-08-15 16:13 Bitmain Note Added: 0009201
2024-08-15 16:21 Bitmain File Added: Composr_cookie error.JPG
2024-08-15 16:21 Bitmain Note Added: 0009202
2024-08-15 17:58 PDStig Note Added: 0009203
2024-08-16 17:21 Bitmain Note Added: 0009204
2024-08-16 17:26 PDStig Note Added: 0009205
2024-08-16 17:26 PDStig Note Edited: 0009205
2024-08-16 17:27 PDStig Note Edited: 0009205
2024-08-16 18:05 Bitmain File Added: Composr News_Image NOT added.JPG
2024-08-16 18:05 Bitmain File Added: Composr_Admin Logn Loop.JPG
2024-08-16 18:05 Bitmain Note Added: 0009206
2024-08-16 21:44 Adam Edington Note Added: 0009207
2024-08-16 21:46 Adam Edington Note Edited: 0009207
2024-08-17 00:57 Adam Edington Note Edited: 0009207
2024-08-18 01:02 PDStig Note Added: 0009236
2024-10-12 18:48 PDStig Status Assigned => Closed
2024-10-12 18:48 PDStig Resolution open => not fixable