error message - reference?

[brynn]

Hi Friends,
Is there any kind of reference where we can look up various error messages, to learn what they're about?  I hate to always have to take up your time asking about them.

Actually, I have searched, but didn't find anything.  I'm hoping maybe I just missed it?

In case there isn't a reference, here's the error.  It just started about a month ago, but I can't think of any particular change I might have made at that time.  It looks like people are having trouble logging in.  And it looks like maybe they have their referrer header blocked.  But I don't remember seeing any kind of setting in the admin panel about requiring that.  Although there's every chance it could be technical language that I don't understand.

https://www.inkscapecuttingdesign.com/smf/index.php?action=login2
Unable to verify referring url. Please go back and try again.

Do you need to see my list of mods?  I'm thinking maybe Forum Firewall might have something about it?  (It was installed for me, some time ago, but I'm no longer in touch with the person who installed it.)

I did migrate to a new server close to 2 months ago.  I don't suppose this could somehow be a server setting?

Thanks for your help   

[Sir Osis of Liver]

Can you post errors from your forum or server error logs?

[vbgamer45]

Make sure simple portal is on the latest version.

Custom themes might need to their index.template.php editor and the login template for them edited.

[Sir Osis of Liver]

Hmm, if you go to https://www.inkscapecuttingdesign.com/smf/index.php?action=login2 you get the referring url error, but if you go to https://inkscapecuttingdesign.com/smf/index.php?action=login2 you sometimes get the session timeout error (not always).  Are all paths in repair_settings with/without www.?

[Aleksi "Lex" Kilpinen]

I did migrate to a new server close to 2 months ago.  I don't suppose this could somehow be a server setting?

Do make sure all settings for the forum, and themes are structured in the same way.
All either with or without SSL, and all either with or without WWW, but no mix and match.
The login / logout functionality may not work right if there are different types or urls involved.

Start with repair_settings, like Sir Osis of Liver suggested.

[brynn]

Can you post errors from your forum or server error logs?

The forum error is posted in the op.  Can you or someone remind me the name of the file which is the error log, on the server.  I know someone told me before, but I don't remember where it is, or what it's called. 

Make sure simple portal is on the latest version.

Custom themes might need to their index.template.php editor and the login template for them edited.

It looks like the current Simple Portal version is 2.3.7 and I have 2.3.6.  Not too bad.

I can't quite understand your last sentence.  Are you saying to edit something?  I'm not sure how custom themes could be affecting logins.  I don't think anyone is even using a custom theme on that forum.

Ok, what is this about repair settings (quote below)?  I seem to recall that repair settings is something I need to download?

Are all paths in repair_settings with/without www.?

Start with repair_settings, like Sir Osis of Liver suggested.

Ok, please tell me what to do with repair settings.  I think I used it when I switched to SSL/https.  Are you saying to just run it again?

Edit
I thought it didn't matter whether you used www or not.  I thought browsers would find the right place, either way, these days?

[Aleksi "Lex" Kilpinen]

Yeah, run it again and go through all the urls, make sure they all start the same way. Http or Https, www or no www. 

[Sir Osis of Liver]

Server error log is usually in forum root, it's named errorlog or error.log or something similar.  On some hosts you may not see it.

repair_settings.php

[Arantor]

Browsers only find the right place with www or not if the server and/or DNS are properly configured. They have always been, and continue to be, two separate things.

[vbgamer45]

SMF did do an update at one point that requires any login form to be updated. So that's why i was saying update simple portal.
Arantor also released a mod that auto fixes login forms for this issue

[brynn]

Thanks for everyones' comments, and sorry for my delay responding.

SOL, do you still want to see the server error log?  I think I have to ask my host for it, and then they upload the relevant section for me.  The only ones I see there are for a year ago or something, and then just a few lines.  There's an error log in cPanel, but I haven't actually figured out how to use it.

When I switched to https, I followed these instructions:  https://www.simplemachines.org/community/index.php?topic=555034.0  Specifically, item #6 there, is what I followed.  Pasted below, for convenience:

- $boardurl
- Your Smileys URL
- Your Avatars URL
- Your Custom Avatars URL (if you have one)
- Your Theme URL (one for each theme!!!!)
- Your Theme/Images URL (one for each theme!!!!)

I have a vague recollection that there was more in repair settings than just those 6 items, with the emphasis on "vague".  If there are more items, are you saying to look at and fix all of them?  Or just those?

I actually can't figure out how this problem happened.  Not unless there was a problem during the server migration, and they messed it up then?  I swear, not one of them knows what the other is doing....or cares to find out!  So who knows what might have happened?

Browsers only find the right place with www or not if the server and/or DNS are properly configured. They have always been, and continue to be, two separate things.

I don't understand why they are separate, actually.  I mean, if someone owns the domain, it would be a little bit crazy to put one site on www.abc.com and another site on abc.com.  It seems like they ought to be completely interchangeable.

How can I find out about how the server and/or DNS are configured?  I would want to make sure that if I decide not to use www (when I go through the repair settings) but someone puts www in the address bar, that they will still get to my site, which isn't using www.  (Or vice versa)

Yes, I'll upgrade Simple Portal as soon as I get through with repair settings.

Thanks again.

[Aleksi "Lex" Kilpinen]

Browsers only find the right place with www or not if the server and/or DNS are properly configured. They have always been, and continue to be, two separate things.

I don't understand why they are separate, actually.  I mean, if someone owns the domain, it would be a little bit crazy to put one site on www.abc.com and another site on abc.com.  It seems like they ought to be completely interchangeable.

Because technically speaking, www.abc.com is a subdomain, just like forum.abc.com

How can I find out about how the server and/or DNS are configured?  I would want to make sure that if I decide not to use www (when I go through the repair settings) but someone puts www in the address bar, that they will still get to my site, which isn't using www.  (Or vice versa)

At this point, I wouldn't go there. There are easier solutions to the problem, like htaccess redirects and so on. But first you should make sure all the settings in SMF are at least correct, and only after worry about the rest. SMF can handle much of it on it's own if properly configured.

[brynn]

Because technically speaking, www.abc.com is a subdomain, just like forum.abc.com

Really??!  Maybe I should just ask if you know where I can learn more about that, because I have a million questions!  I thought www was just a code which means "world wide web", meaning "go to that part of the internet".  And I thought not having www meant the same thing.  Otherwise, I thought there were different codes, which would bring you to different parts of the internet....like "the dark web" maybe, or like maybe nasa has it's own section, or something like that....and I thought universities had their own little corners of the internet which are identified by something else besides www.  I'm sure I've seen some addresses like w1.abc or w2.abc.  I saw one like that just a few minutes ago, actually.

In cPanel, it sure doesn't show www as a subdomain....  See what I mean, Lots of questions 

Ok, thanks for your comments.  I'll fix up SMF.  But later, I probably do want to dive into htaccess.

[Aleksi "Lex" Kilpinen]

www is basically a historical remnant that would not be needed, and in reality commonly sites do use only one or the other, but could provide the same content on both. But because historical reasons, abc.com and www.abc.com are 2 different locations for the DNS system.

[Sir Osis of Liver]

You can use an .htaccess rewrite to redirect domain.com to www.domain.com, or vice versa, but shouldn't be necessary if server is properly configured.

Something like this -

Code Select Expand



#Force www:
RewriteEngine on
RewriteCond %{HTTP_HOST} ^domain.com [NC]
RewriteRule ^(.*)$ http://www.domain.com/$1 [L,R=301,NC]



[Arantor]

www is basically a historical remnant that would not be needed, and in reality commonly sites do use only one or the other, but could provide the same content on both. But because historical reasons, abc.com and www.abc.com are 2 different locations for the DNS system.

It hails from the days when you'd have www as your website, mail for the domain's email server and so on - but the advances in the underlying protocols (esp HTTP/1.1) you could have proper name-based virtual hosting where this wasn't needed.

[brynn]

Hhmm, I seem to be having some trouble finding repair_settings.php after I upload it.  In the forum where I'm having this problem the worst, I upload it to the root directory, which is public_html/inkscapecuttingdesign/smf.  Then I browse to hllps://inkscapecuttingdesign.com/smf/repair_settings.php.  But it redirects to hllps://inkscapecuttingdesign.com/smf (where I see the warning that repair settings is still there) but I don't see repair settings itself.

To try and jog my memory, or give me a clue, I uploaded it to my other site, which is in public_html/forum.  When I browse to hllps://forum.inkscapecommunity.com/repair_settings.php, I get a server error.

[edit - note that I also tried browsing to the http version of those addresses, and also with and without www - same result]

I have a feeling I'm not browsing to the correct URL to find repair settings.  But given the server error (and other problems with this new server), I wonder if it has something to do with my server, that I can't find it??  I did not have this problem when I switched to https originally.  Everything went right through according to the instructions.

This is from the error log in cPanel (not from the main error log which I have to request from my host).  But maybe it will help?

[Tue Jul 03 02:41:45.426993 2018] [:error] [pid 24413:tid 140563760224000] [client my IP address] SoftException in Application.cpp:388: UID of script "/home/brynn/public_html/forum/repair_settings.php" is smaller than min_uid

[Tue Jul 03 02:39:37.766488 2018] [:error] [pid 24440:tid 140563718260480] [client my IP address] SoftException in Application.cpp:388: UID of script "/home/brynn/public_html/inkscapecuttingdesign.com/smf/repair_settings.php" is smaller than min_uid

Thanks for any comments.

[Kindred]

that looks like some idiotic piece of "security" that your host has put in place -- or maybe a badly formed htaccess.

[Arantor]

Misconfigured security script, not .htaccess.

How did they mess it up that badly that uploading a file via FTP assigns a UID that can't be used? Contact your host.

[brynn]

Will do.  Thanks!

[brynn]

At the moment, they think it is a file permission issue.  The permission is 0644.

When I look at the root directory, most of the files seem to have 0644. All the files seem to have 0644.  All the folders have 0755.

Is that proper permissions?

[Arantor]

Those permissions are absolutely fine.

The error message quite clearly talks about a UID, which is not related to file permissions, but to who owns the file, and who the file can be executed as.

[Aleksi "Lex" Kilpinen]

Your host does not seem to know what they are doing to be honest.

[brynn]

Yes, I totally agree with you about my host.  I'm not very happy with them at all.  I'll probably look into moving to a new host, as soon as I can catch up on my to-do list.

After they found out that the permission was fine, then they also concluded the problem was with ownership.  So they fixed that.  And I've already run the repair tool.

There was only one folder that was missing the www, which was the custom avatar folder (where members upload their own av).  I don't know if that will fix the problem which brought me here.  Going back to the first few messages, we can pick it back up there.

I guess when you all were looking at the login page, it was not always showing the correct url?  I can't reproduce that, myself.   But does it look like the repair tool fixed that? 

Or are you saying the error message means that the referring url is sometimes with and sometimes without www?  I thought "referring url" meant the referrer header (which many people have blocked or disguised).

Hhmm...I've tried searching one of the IP addresses which is frequently causing this error, but they don't seem to be a member.  I guess they could have reg'd with a different address though.  Hhmm....I've searched 5 IP addresses which are producing this error, and none of them seem to be reg'd with those IPs.  Could this somehow be non-members trying to log in?

Now I've searched 9 or 10 IP addresses.  So far, none of the addresses which are causing this error are found in a member search.  That seems like a clue, to me.  Although I'm not sure exactly what it means....

[GigaWatt]

The only problem I'm seeing (mind you, this is not a big problem) is the unlocked keypad in front of https when loading the page. Some elements from your site are loading through http instead of https (most likely some images). It's probably a link or an image loading from the Home page, since everything is loading correctly on the Forum page (locked keypad). Check the hyperlinks and/or image URLs loading on the Home page .

In any case, the forum loads either way, with or without www in front, if that is what you were asking.

Could this somehow be non-members trying to log in?

It could be bots trying to register or log in.

Now I've searched 9 or 10 IP addresses.  So far, none of the addresses which are causing this error are found in a member search.  That seems like a clue, to me.  Although I'm not sure exactly what it means....

Are all of the addresses in a different range?

BTW, I really like the favicon design .

[Shambles]

... Some elements from your site are loading through http instead of https (most likely some images). It's probably a link or an image loading from the Home page ...

You can click the padlock and interrogate the media to see what's insecure.

Almost all the insecure items on the home page are loading from http://forum.inkscapecommunity.com/tp-files/tp-articles

[GigaWatt]

Hmmm... never thought of doing that, the page info section. Thanks for the tip though .

And you're right, most of the not secure items come from http://forum.inkscapecommunity.com/tp-files/tp-articles

[brynn]

Sorry for the delay (again)  (arrgh!)

Thanks for the info re the padlock.  I realize that some pages have mixed contents.  That's actually what I was working on, when I noticed these errors.  The errors sounded to me like maybe people are having trouble logging in, although not knowing for sure is why I posted.  And also hopefully you can help me learn how to fix them.

Just to kickstart this topic again, this is the error message I'm getting:

https://www.inkscapecuttingdesign.com/smf/index.php?action=login2
Unable to verify referring url. Please go back and try again.

The concensus on advice was to run the repair_settings and make sure everything is consistent (all with www or all without).  So I did that, and I only found one file missing the www, which was the custom avatar file.  That does not sound like it could have been causing this problem, but I guess I don't really know.

In any case, now everything has h..ps://www.inkscapecuttingdesign.com/ for the beginning of the url.  But I'm still getting  fairly a lot of these errors.

As noted a few messages above, from what I can tell, it looks like these are not members trying to log in.  But on the other hand, an error is an error, and I have not seen them before.  It would be nice to fix, if possible.

What referring url is it talking about?  I thought it meant they had the referrer header blocked.  But I guess you all were thinking they it was something to do with whether the www was in the address?

Thanks
(And sorry again for the delay.)

[Illori]

https://wiki.simplemachines.org/smf/Login_error_2.0.14

[GigaWatt]

And the problem with the padlock on forum.inkscapecommunity.com are the links in the TinyPortal articles. Notice these links in the screenshots I posted.

Code Select Expand

http://forum.inkscapecommunity.com/tp-files/tp-articles/images/denimbg3.png
http://forum.inkscapecommunity.com/tp-files/tp-articles/images/lbdr9.png
http://forum.inkscapecommunity.com/tp-files/tp-articles/images/InksTuts.png
http://forum.inkscapecommunity.com/tp-files/tp-articles/images/favicon.png
http://forum.inkscapecommunity.com/tp-files/tp-articles/images/v45.png
http://forum.inkscapecommunity.com/tp-files/tp-articles/images/v46.png
http://forum.inkscapecommunity.com/tp-files/tp-articles/images/v47.png
http://forum.inkscapecommunity.com/tp-files/tp-articles/images/v48.png
http://forum.inkscapecommunity.com/tp-files/tp-articles/images/v91.png
http://forum.inkscapecommunity.com/tp-files/tp-articles/images/v92.png
http://forum.inkscapecommunity.com/tp-files/tp-articles/images/vdk.png
http://forum.inkscapecommunity.com/tp-files/tp-articles/images/denimbg2.png
http://forum.inkscapecommunity.com/tp-files/tp-articles/images/favicon.png

All of them have to be changed to start with https to make the padlock secure (locked).

Oh, and about the 2.0.14+ login fix, you have to implement it on all your themes (I see you have a theme changer on inkscapecuttingdesign.com).

[Kindred]

Oh, and about the 2.0.14+ login fix, you have to implement it on all your themes (I see you have a theme changer on inkscapecuttingdesign.com).

or use the mod linked from that FAQ article

[brynn]

https://wiki.simplemachines.org/smf/Login_error_2.0.14

Thanks Illori!  Is that maybe just for researching the problem?  It doesn't seem to be the same problem I'm having.  There is no timeout in the error message.  And regarding the themes, I doubt if this is happening in themes, since it seems to be non-members, and non-members don't have access to change themes....ummm, well actually I might be wrong about that.  Is there a way to find out, from the error message (or from something else) if someone was using a non default theme when the error happened?

And the problem with the padlock on forum.inkscapecommunity.com....

YES, I'm aware of those.  I'm working on it.

Oh, and about the 2.0.14+ login fix, you have to implement it on all your themes (I see you have a theme changer on inkscapecuttingdesign.com).

or use the mod linked from that FAQ article

InkscapeCutting Design will probably be set to read-only shortly.  (It's next to dead.)  So I probably won't fix that.  However the error also happens in Inkscape Community, although with Much less frequency.  So I thought using InkscapeCuttingDesign for troubleshooting might be easier to find/fix the problem, since it happens so much more there.  I will fix it in Inkscape Community.

But about the error message I reported.  Are you saying this is the same thing?  Just going by the description, they don't sound like the same thing to me.  Plus, it's a really long time since I installed 2.0.14, but the problem just started a couple of months ago.

[Kindred]

actually, the problem with referring URL usually happens (these days) when you have your https redirect misconfigured.


because http://somesite is different from http://www.somesite is different from https://somesite is different from http://www.somesite

[brynn]

Hhm, ok.

I was just comparing what's in my htaccess file, to the redirect rules you showed earlier in this topic.  They are significantly different.  It's a little more similar to what is suggested in the tutorial for converting to https here:  https://www.simplemachines.org/community/index.php?topic=555034.0  But still different.

Here's what's in my htaccess file, which my host wrote (which I trust about as far as I can spit).  (Yeah, we're still trying to sort out the server migration which they essentially forced me into, which happened 2 or 3 months ago.)

RewriteEngine On
RewriteCond %{HTTPS} off
RewriteRule (.*) https://%{HTTP_HOST}%{REQUEST_URI} [R,L]

I've been thinking I'll try to learn how to write whatever kind of code that is, so that I can write exactly what I want.  But little things keep coming up, like this error message.  Where can I learn how to write those rules?

[Kindred]

and what is the url of your forum, as defined in the server settings?

In addition to https, you need to either force www or force the removal of www -- whichever you have set as the actual forum url

[lurkalot]

Just to kickstart this topic again, this is the error message I'm getting:

https://www.inkscapecuttingdesign.com/smf/index.php?action=login2
Unable to verify referring url. Please go back and try again.

Brynn, You have a Simpleportal login block running on the left side of your page. That version of Simpleportal 2.3.6 has the login bug, they fixed it in version 2.3.7

So perhaps update to 2.3.7 or just turn off that block and see if the login error goes away.

[brynn]

Kindred, I thought it was h..ps://www.inkscapecuttingdesign.com.  But I'm not sure exactly where to look to find out.  Every place I've looked so far, it does not have www.  But I've always used www on the website.

lurkalot, I will try that asap (probably tomorrow).  But I do have the same error happening on the other forum, which is running TP.  But TP is also out of date, so if it has the same kind of option, that could explain it.

Oohh!  Yeah, definitely tomorrow, haha.  You said "...login block running...." which I thought meant there was some kind of blocking of logins happening.  But you mean a portal block where people can login, right?  Maybe I'm a little too tired right now!

But I'll still do the upgrades tomorrow 

[brynn]

Ok wait, before I launch into these upgrades, I wanted to be really clear about this.

lurkalot, when you're talking about login bugs that are fixed with the upgrades, which login bug are you talking about?  Do you mean the one which Illori mentioned?  Or are you talking about the error messages I've mentioned?

I'm still having a hard time understanding how these could be the same thing.

Are you saying (or at least speculating) that the errors are coming from people clicking on the portal block to log in? (non members, maybe would-be spammers)

And that disabling the block might be a good test for that?

[Aleksi "Lex" Kilpinen]

If the errors stop by disabling thw block, then it is clearly that. The login form for SMF was changed, and the Portal had to change too, in order to function properly.

[Arantor]

Good thing that Login Fix mod works on SP as well then

[Aleksi "Lex" Kilpinen]

Oh, did not know that. Good thing then, yes.

[Arantor]

It fixes any login form on the page that it finds by examining the HTML itself and rewriting it on the fly, which is why it works on basically any theme.

[brynn]

Thanks Lex.  Yes, I understand that part.  I had 2 reasons for saying "speculating".  One is how do we know that the error (the one I'm getting) isn't coming from people using the regular login page? 

And 2nd, I don't understand why everyone seems to be thinking that the error messages I'm getting are the same bug that Illori referenced.  Maybe I'm interpretting the description too literally?  (Although to me, I don't see any part of the description that fits.  Only "login" in general is in common.)

Ok, well I'll disable the block and see what happens.  And I'll download the files and get ready to upgrade.

Thanks again, everyone!

[Aleksi "Lex" Kilpinen]

I think we are all just going down a path of eliminating obvious culprits one by one, it may not be that - but you have a good way to find out if it is at least involved, so testing doesn't hurt.

[brynn]

Thanks for clarifying, Lex

Early indication is that disabling the block is not stopping the error.  I disabled it immediately after I posted my last message (July 12th).  I have one of those errors on July 13th.  But I'm going to let the testing go on a little longer, just to be sure.  After that, I'll still do the upgrades anyway.

[brynn]

Good news.  That error on the 13th has been the last one.  So I think disabling that block did stop them.

So now I will do the upgrades.  Cross fingers (there's a reason I tend to avoid upgrades).

Thanks again for everyones help!