I recently upgraded from YabbSE to SMF.
After the conversion the cookie name stayed as YabbSECookie151 or whatever it was called (I assume just so nobody would have to re-login).
Trying to test permissions I came across the "can't logout bug" which has been incorrectly identified in other threads as a "fake" bug - nope - it exists.
I tried to log out to see what unregistered users could see.. anyways I ended up deleting my cookie and once I was logged out I couldn't log in perm again.. it logs me in until I close the browser window.
Trying a suggestion I saw on here I changed the cookie name (its now SMFCookie) and so the old YabbSE cookies were working fine but now everyone is having the "can't stay logged in" bug as their old valid cookies (from yabbse) aren't being referenced.
This is definately not a "fake bug" nor is it a browser issue as all the members of the forum are experiencing it from Internet Explorer to Mozilla to Opera.
Please don't chime in and say "Works fine for me in Opera - so no bug" because its there. You may not experience it but its still happening to many people on may different computers with many browsers.
So I think the problem is cookies - now that we aren't using the old yabbse ones nobody can stay logged in.
Any suggestions are greatly appreciated - thanks.
Quote from: Terragen on April 10, 2004, 12:31:17 PM
"can't logout bug" which has been incorrectly identified in other threads as a "fake" bug
If you get an error mssage, please try closing your browser and opening it again. If, on the other hand, it jsut doesn't log you out please make sure "global cookies" and "local cookies" are off, or try changing the cookie name in Server Settings.
Please give me a URL so I can test it. I can also give you SEVERAL topics on the issue.
Furthermore, this is not a bug on the site - Site Bug Reports (http://www.simplemachines.org/community/index.php?board=19.0). Nor do I even, sorry to say, believe it is a bug - rather a misconfiguration.
-[Unknown]
LOL. I actually got a
"An Error Has Occurred!
Session verification failed. Please try logging out and back in again, and then try again "
error here while trying to post.. refreshing a few times fixed the problem.
Anyways there's no logout error - it simply did not work (which I think was a problem with SMF using YabbSE cookies - everyone had that problem.. now that the cookie name is changed everyone can log out - except "logging in forever" doesnt work.
The problem wasn't an error - clicking logout would simply return you to the main page without clearing the cookie or session or whaver - it was like clicking on the "home" button.
If its a misconfiguration well then its a bug to distribute SMF improperly configured. (Or to even allow it to be misconfigured so) although I'm not sure how you can "misconfigure" cookies. It worked fine in YabbSE - I downloaded the SMF update and it hasn't worked since then. So if its a "misconfiguration" its an SMF problem as I haven't changed any of the options (except the cookie name as I said - which shouldn't be a problem.. although it wasn't working before I changed it either).
I'll PM you a link.
Local cookies are off.
Also as I said before I did change the cookie name - which didn't fix the problem.
The YabbSE cookies worked fine - except you couldn't log out.
Now that I changed the cookie name everyone had to get a new cookie and since they werent using the working YabbSE cookies they have the new cookies in which "forever" has been defined as "until you close the browser".
make sure you go to tools -->Internet Options---> Privacy and move the slider till it says Except all Cookies and click the apply button then click ok and then you should be able to stay logged in that happend to me once when i didnt have all cookies enabled but if it doesnt work that is something else
Regards
Homie
Thanks for the input :)
But thats not the problem - I accept cookies fine - I *can* login - just not permenantly.
Terragen,
I'll explain EXACTLY why this usually happens to you. You're actually experiencing two very annoying problems with cookies, and they are not anything to do with SMF being "improperly" distributed.
If you have YaBB SE cookies set, and turn ON global cookies, you won't be able to log out (no error, it just won't work!) without clearing your old cookies. SMF's YaBB SE upgrade package is distributed with global cookies off.
If you set the cookie to an invalid cookie name - SMF by default uses a valid one - the cookie will not "stick" because the browser will, basically, forget it. Pass it over because it's not valid. Either in Beta 4.1 or the cvs, the cookiename should not be changable to anything but a valid value. (spaces, dashes, everything but A-Za-z0-9 is bad.)
You are explaining EXACTLY these problems, to the letter. Have you tried deleting your cookies for that domain? Have you tried using a different browser to be sure it's not your Internet Explorer settings?
-[Unknown]
I have no turned on global cookies.
When I ran the SMF update it stuck with the YabbSE cookies so nobody would have to relogin (I imagine). This worked fine.
Anyone who deleted their YabbSE cookie had the problem of not being able to stay logged in. I tried and this also happened to me. Following a suggestion in another thread I went to settings and changed the cookie name from the YabbSE cookie (Which worked) to SMFCookie (which as far as I can tell is a valid name). Now that the cookie name is changed EVERYONE has this problem (since the board isn't using the GOOD YabbSE cookies but rather trying to make new cookies and its not working correctly. Its not my computer or my browser - since cookies work fine everywhere else. Also everyone on the board is now having the problems (now that the cookie name is changed and nobody is using their old yabbse cookies) and some people are using opera, some are using mozilla, some using IE. So it is clearly not a browser or cookie permissions issue but it must be something to do with SMF. (Mine and everyone elses cookies worked with YabbSE and work on all the other boards we post on and now only don't work on SMF).
I have not changed any of the settings except for the name of the cookie - so if there are any "bad" settings they were deployed with SMF as all my settings have not changed (except cookie name) since then.
Also if that was you that created the tester account (with
[email protected]) you'll never get that email so I just activated the account for you. You can try and experience the cookie problem yourself.
It works to a point (ie: if you dont leave the site for too long) but more ofen that not I get logged back out.
Hopefully we can figure out what this is since I have no clue.
Your server is mangling the set cookie header. This could be caused by an invalid cookie name ("SMFCookie " or " SMFCookie" or "SMF Cookie"), but can also be caused by your server setup.
Can you give me a link, through pm or otherwise, to a phpinfo.php? This is a file with only these contents:
<?php
phpinfo();
?>
The thing is that the cookies are, as I explain in another topic, set in the same way as YaBB SE set them.
As far as the login working for a period, this is because it's using sessions; in YaBB SE, login wouldn't even work at all with these problems. And, on that note, my testing showed me that on every page view the PHPSESSID cookie is being set - except the one that should be setting the authentication cookie, which leads me to believe that the "Set-Cookie" header is being mangled, as I said, or just plain not sent. (some server setups think they are too smart for PHP scripts; they apparently know when a cookie is not "neccessary".)
-[Unknown]
Well the cookie name is SMFCookie (thats a valid name isn't it?)
I haven't changed any of the server settings and never had a problem in YabbSE so I'm not sure what would be happening now.. :(
I'll PM you a link to phpinfo
Thanks for looking at this as I'm completely baffled and I know it worked before.. so I'm not sure what is going on :(
You seem to be using PHP in CGI mode under IIS 4.0 on Windows NT 4. This is not a horribly stable or fast setup, and using ISAPI, Apache, and/or a newer version of Windows would most likely solve the problem.
In fact, as of this July, NT 4.0 will not even be supported by Microsoft, nor will be the version of IIS you're using.
If you have any control at all over the server, you may want to try to address these issues. While I can't promise they will solve the problem, I can tell you that PHP and all PHP scripts will run significantly faster in ISAPI mode, and under newer revisions of IIS.
If you don't, I'm not sure - this really says to me "server issue". Have you read this topic?
http://www.simplemachines.org/community/index.php?topic=7721.0
-[Unknown]
Thanks, I'll look at the topic.
Yeah that server has been up for a few years - because there were no great (free) solutions for running ASP on apache (it was pretty much IIS or nothing) and I needed to run some ASP pages... I was thinking about upgrading it all in the summer to Slack/Apache
but if the cookies are set in the same way as YabbSE then there shouldn't be a problem. I've had a YabbSE board up for almost 2 years there and NEVER had a problem like this.. and nothing has changed on the server - the only thing that has changed is the forum software (YabbSE->SMF) which is why I think SMF is pretty much the only thing.. I mean it ran fine with YabbSE :/
I'll look at that other topic - thanks.
I've turned on subdomain independant cookies - I've also tried the replacement suggested in the thread you linked (And yes I put my domain in the code)
Still not working.
:(
The way cookies are handled is one of the few things that has hardly changed in SMF.... I'm not sure what to tell you.
-[Unknown]
Alright well thanks for looking - I appreciate the time :)
It must be something in SMF though - I just made a testing copy of the old yabbse board with a backup database
(basically a mirror of the site right before SMF update)
and the cookies set fine (I checked using opera - with the SMF I only get phpsessionid but with yabbse I also get the yabbse cookie)
I've tried changing the cookie name, I've tried subdomain indepenadant cookies i've tried local and global cookies. Nothing works.
There must be some setting somewhere thats different from yabbse because I know the server is fine (I can set cookies using yabbse so php etc is working fine) and there must be a setting i'm missing somewhere in smf.
its driving me crazy lol.
couldit be something like its using sessions before it tries cookies?
i'm totally puzzled.
It always sets the cookie, and it sets it in exactly the same way - as I described in that topic.
-[Unknown]
That's totally bizzare :D
Well I guess I'll try reinstalling SMF then.. I mean I know the cookies work on my end and the server as the test YabbSE board is setting them.. hopefully its something really weird that a reinstall will fix.. if not I guess i'll go wading through the php code
Thanks :)
Hrm.
Alright I can make a separate php file and set a test cookie in it. but if i try to set it when the other cookie is set it won't go either.
lol
I tried reinstalling SMF fresh and doesnt work either
man i'm really confused.
This just sounds like a screwed up server to me :P.
-[Unknown]
Quote from: [Unknown] on April 16, 2004, 05:36:37 PM
This just sounds like a screwed up server to me :P.
-[Unknown]
But its ONLY the SMF files.
YabbSE works fine. If I make my own script it works fine.
If I copy and paste a working setcookie call into the SMF file it doesn't work.
I know IIS is horrible (like I said I only used it because there wasn't any good free way to use ASP in Apache a few years ago when I put it up) but it seems ridiculous that its "biased" only against smf lol.
I can't be that crazy because I've seen a few other people here post of similar problems.
I just want my cookies to work lol
:'( :'(
I use IIS 6.0 without issue...
It sounds like the server is breaking the Set-Cookie header when two cookies are set, or something.
Try putting ob_clean(); before the setcookie call.
-[Unknown]
tried obclean but still not getting the cookie set :(
damn microsoft.. well I guess i'll have to keep logging in until I can get the time to switch over to apache
thanks again
In order to get the cookies working i've had to change some of the code. Hopefully I can get Apache on soon and get this sorted out :/
Anyways for anyone else with the same problem
Replace:
header('Location: ' . str_replace(' ', '%20', $setLocation));
With:
print '<html><head><meta http-equiv="refresh" content="0;URL=' . str_replace(' ', '%20', $setLocation) . '">';
print '</head><body><a href="' . str_replace(' ', '%20', $setLocation) . '">Click here</a></body></html>';
in function redirect exit in subs.php
an annoying fix but seems to be the only way to get IIS to set cookies.
Umm.. SMF uses no such code...? Do you mean add that to the redirectexit() function?
I should note again that it does work with IIS, just probably not really old versions of IIS :P.
-[Unknown]
Sorry I copy and pasted the code but apparently the second time it didn't grab it in the clipboard :D
i'll edit the post
mhm, did you try just a fresh install of SMF? If it works than there is a hard to find missconfiguration ;)
Sorry, I have this thing about xhtml compliancy...
Replace, Sources/Subs.php:
header('Location: ' . str_replace(' ', '%20', $setLocation));
With:
echo '<html>
<head><meta http-equiv="refresh" content="0;URL=', str_replace(' ', '%20', $setLocation), '" /></head>
<body><a href="' . str_replace(' ', '%20', $setLocation) . '">Click here</a></body>
</html>';
Although, javascript could also be used, and so could i18n..
-[Unknown]
Quote from: treo on April 23, 2004, 03:56:23 PM
mhm, did you try just a fresh install of SMF? If it works than there is a hard to find missconfiguration ;)
Nope - its an MS bug (from 1997) - they didn't follow CGI standard. So YabbSE must have used a different method because it worked fine then.
The problem is IIS ignores cookies when there's a redirect in the header. This solves that problem (With the html refresh). I suppose you could use the YabbSE method whatever it is because it worked fine but the SMF implementation exposes the MS bug (I finally found out what it was lol).
So yeah a fresh install of SMF didn't work either - but its MS's fault.
The YaBB SE method was to not do anything, but that could cause problems because you didn't know if login actually worked...
-[Unknown]
Hi :)
I seem to have developed the same little problem a day or two ago.
I've been running "SMF 1.0 Beta 4.1 Public" without any problems... then suddenly one of my members messaged me from another forum about this problem as they couldn't log out, post, or send IM's on my one! ???
another member had it too but seemed to have fixed it by logging out and then back in again.
Upon checking myself, I found I had the log out problem too and was unable to post or start new topics.... I either had session timeout errors (despite taking merely a moment or two to try posting) or the message to log out and log back in again (which i was unable to do without deleting my cookie) so I changed the cookiename to see if that might help yesterday.
It made things better for me :D but the first member messaged me again today having come back to test if things were back to normal but found the same problems!
QuoteIt won't let me post without the time out error even though I'm really quick and it wants to keep me forever cos it won't let me log out again :'( I want to go home :'(
I went to have a look and although I can post and start new threads, i cannot log out.
I've now noticed that local cookies were on... :-[ so have switched them off... and renamed the cookie again... think my account seems ok now ;D
I'm hoping the local cookie thing was my prob :D
Sorry to take up your time with this post if my problem is solved but thought maybe I'd make mention of it.
You might just be seeing the sessions working
if you get a browser like opera you can check on the cookies to see which ones have been set by the server.
IF you're only getting the PHPSESSID cookie then thats the session and you are having the same problem - SMF sends the logincookies but then redirects you to the main page but if you're on IIS the redirect causes the login cookies not to get sent
so check your cookies to see which ones are getting set :)
I would assume sessions are not properly working on your server. This is common on sourceforge and other load balanced servers.
-[Unknown]
I want to point out that while I have the same problem, I found a temp solution (which in truth isn't really a solution). If you were logged in before, and after either closing the browser or visiting another website, and upon re-entering the forum visitors will have been logged out and shown as guests. But I discovered that by just clicking the home button, or attempting to view any of the boards will automatically log you back in (without having to type in username & pass)! Weird.. so basically, if you have this problem, all you need to do is re-click the HOME button and it'll reload the page and log you in at the same time.
Edit: I did created a FAQ and directed all new users and visitors to it using the news box, and told them that's all they needed to do to relogin without any hassles.
My board: http://bashyou.net/garion/forum
That sounds like a caching issue to me...
-[Unknown]
Quote from: [Unknown] on April 24, 2004, 06:42:14 PM
That sounds like a caching issue to me...
-[Unknown]
Hm.. the YABBSE forum that I'm also running doesn't have the same issue (at least nobody has raised it). So.. I guess this caching problem only manifests itself in SMF?
Quote from: -Garion- on April 24, 2004, 06:34:58 PM
I want to point out that while I have the same problem, I found a temp solution (which in truth isn't really a solution). If you were logged in before, and after either closing the browser or visiting another website, and upon re-entering the forum visitors will have been logged out and shown as guests. But I discovered that by just clicking the home button, or attempting to view any of the boards will automatically log you back in (without having to type in username & pass)! Weird.. so basically, if you have this problem, all you need to do is re-click the HOME button and it'll reload the page and log you in at the same time.
Exactly the same here...
Uhmm, any news on this. I still have the same problem.
I still have that problem on one of my boards. I'm running two SMF forums right now under the same domain name, each with their own MySQL database, and only my personal SMF board has that issue. I compared cookie settings on both.. and they're exactly alike.. :-\
I've had the "can't stay log in prob" as well.
The solution in my case was simple but effective, installing php as isapi instead of cgi did the trick. If you have this problem and enough control over your server I suggest you do the same.
Note that while installing as isapi I also installed php 4.3.6 instead of 4.3.1, so that could be the solution as well.
P.S. In my case it was a windows 2000 adv. server running IIS 5.0
I have a user at my site with the same issue. He cannot stay logged in for more than 24 hours.
"Ever since the switch to SMF, I've had to log-in every day, in spite of using "forever" while signing in.
Is the cookie set to expire after 24 [or so] hours, or do I have to enable something?
Session cookies and persistent cookies are enabled. Third party cookies and many of the vulnerable functions are disabled [ActiveX, Web Bugs, Mobile Code & etc].
I don't have this problem with Vbullletin, Phpbb, Snitz nor Invision."
Do you have local cookies or global cookies set?
-[Unknown]
I have neither one of these checked
Enable local storage of cookies
(SSI won't work well with this on.)
Use subdomain independent cookies
(turn off local cookies first!)
The cookie it is setting expires on Friday, May 28, 2010 9:20:51 PM.
-[Unknown]
Seems this was most likely another software issue causing this.
Those of you still having this issue may wish to loo at your Zone Alarm settings.
For those of you using this that is.
Here is a quote from user with that issue:
"I think I found the problem. Self inflicted....
If my thinking is correct, it involves the ZA Pro "cache cleaner" [set to run daily] and a slight change in the name of the cookie.
My ZA "cookies to save" list included cpfools.com. Apparently this was the cookie generated by Invision.
There was another cookie, www.cpfools.com. This may be the cookie made by SMF. I added it to the "cookies to save" list, last night.
I didn't have to log-in this morning.
I think we can rule out any "date change" problems with the cookie. If I make it through the day, we can rule out any "24 hour" problems."
So, at least this could be something for others to review.
For those of you with this type of problem please remember to take a look at the following:
php.ini
---------
session.cookie_domain ""
...
Make sure that this is set to reflect your domain name... easily added to Apache config as:
php_value session.cookie_domain "www.yourdomain.com"
p.s. especially if you use virtual hosts.
Norm
You shouldn't need to change that, though - only if you're using redirection or something.
-[Unknown]
Quote from: npeelman on July 23, 2004, 12:39:11 PM
For those of you with this type of problem please remember to take a look at the following:
php.ini
---------
session.cookie_domain ""
...
Make sure that this is set to reflect your domain name... easily added to Apache config as:
php_value session.cookie_domain "www.yourdomain.com"
p.s. especially if you use virtual hosts.
Norm
Quote from: Hector Gonsales on July 23, 2004, 09:58:33 PM
You shouldn't need to change that, though - only if you're using redirection or something.
-[Unknown]
Not sure if you were replying to me but I use Opera the most (99.9%) and used it's cookie functions to warn me of invalid cookies and that was the problem. The cookie domain did not match the current domain (of my virtual host). Setting the value in my Apache2 httpd.conf file fixed all the problems I was having (ie: couldn't logout, delete messages, etc.) Now it works like a charm.
I have the same problem:
windows IIS 5.1 / php etc etc
can log in fine, browse, post etc, but next time people always have to log in again (stay logged in forever not possible).
tried changing php.ini in several way, but no success yet.
I also tried this test:
<?php
$userid = 1;
$passwd = "passwordstring";
setcookie("project4_userid", "$userid, $passwd", time()+365*24*60*60);
if (isset($_COOKIE['project4_userid'])) {
echo "cookie set: ".$_COOKIE['project4_userid'];
}
else {
echo "The cookie is not set";
}
?>
and it returns the first time a 'The cookie is not set' and after refreshing: 'cookie set: 1, passwordstring'
any ideas??
Can I see a phpinfo.php, please?
-[Unknown]
Btw i think upgrading to rc1 should fix this issue.
cheers
:o
Although I tried everything before, I doubledoubledouble-checked today the permissions for the 'session.save_path = ' in php.ini....
Pretty sure that I have looked at that before, but I found that IUSR had no permissions there.... wooooooooooops
That solved everything for me :-)
Giving IUSR full permissions in the session.save_path-folder and with these settings in php.ini things are working for me:
[Session]
session.save_handler = files
session.save_path = "c:\php4\php4\tmp"
session.use_cookies = 1
session.use_only_cookies = 0
session.name = PHPSESSID
session.auto_start = 0
session.cookie_lifetime = 10000000
session.cookie_path = /
session.cookie_domain =
session.serialize_handler = php
session.gc_probability = 1
session.gc_divisor = 100
session.gc_maxlifetime = 1440
session.bug_compat_42 = 1
session.bug_compat_warn = 1
session.referer_check =
session.entropy_length = 0
session.entropy_file =
session.cache_limiter = nocache
session.cache_expire = 180
session.use_trans_sid = 0
url_rewriter.tags = "a=href,area=href,frame=src,input=src,form=,fieldset="
Quote from: -Garion- on April 24, 2004, 06:34:58 PM
I want to point out that while I have the same problem, I found a temp solution (which in truth isn't really a solution). If you were logged in before, and after either closing the browser or visiting another website, and upon re-entering the forum visitors will have been logged out and shown as guests. But I discovered that by just clicking the home button, or attempting to view any of the boards will automatically log you back in (without having to type in username & pass)! Weird.. so basically, if you have this problem, all you need to do is re-click the HOME button and it'll reload the page and log you in at the same time.
Same here too. Always clicking the Home button when I come back. I don't have any problems coming back to the forums from an email notification though.
AND NO: I'm not running IIS or anything, SMF runs on Apache. All YaBB versions have been there before, never encountered the problem before.
*sighs*
i'm still having this cookie problem, i've created a thread on my site and try and gather information about when, how, why, what... with the problems...
so far i've tried with a few ppl's help (unknown, andrea)
....turning off local and global cookies
....renaming cookie
....using different browers
still the same issues, session verification failures on replying to topics but not posting new topics... accessing admin center....inability to log out
our last attack of fixing things only seemed to last for a day before the same problems came back...
strangely enough some of my members have stated that if they post in one board in particular their problems seem to go away :-\... it sounds pretty bogus to me but if it's right it sure is bizarre...
I also still experience the same problem.... :-\
I have same problem wirh user can't stay logged in, they must relogin each time they visit forum.
Clicking on home, profile and other buttons seems to fix this, so I assume there must be a refresh problem or something like that.
Quote from: zagor on March 06, 2005, 09:12:31 AM
I have same problem wirh user can't stay logged in, they must relogin each time they visit forum.
Clicking on home, profile and other buttons seems to fix this, so I assume there must be a refresh problem or something like that.
Are you using subdomain independent cookies?
-[Unknown]
I tried either local or subdomain and nothing worked.
I also can't logout. Clicking on logout takes me to index forum page.
I converted from yabb 1.3 sp1
check it out: stripovi.net/forum
you can register without email verification.
Sorry, zagor, for taking so long to respond. I suggest you post new topics if you have new support requests.
Works fine for me? Try clearing your cookies.
-[Unknown]