Member error problems logging in..

[Sir Osis of Liver]

Just time for a quick look, two things:

- No problems logging in or posting, different browsers, different IPs.

- https://friendlychatting.co.uk/smf_2/ works fine, https://www.friendlychatting.co.uk/smf_2/ is blocked by Kaspersky due to invalid certificate.  Are you forcing www to non-www?  Can you or your host check your certs?

Back on tonight.  Gotta run .........

[Sir Osis of Liver]

Wow, what a mess.  I get this:

theme=1 quick reply > theme=3 login
theme=1 reply > theme=3 login

theme=2 quick reply > posts - logs out, shows logged
theme=2 reply  > posts - remains logged

theme=3 quick reply > posts
theme=3 reply > posts

If I login to Curve, reply takes me to theme 3 post editor and can post. 

- What's in your .htaccess? 

- Are you using a Let's Ecrypt cert?

Also seems to have affected my browser, got a token error trying to login here.

[justuk]

Are you suggesting my hosting providers SSL is at fault here? And that my site is somehow unsafe? (unless I've misunderstood)

Right...I changed my theme to SMF default CORE theme... couldn't post.. changed it to CORE..same thing,,
Changed it BACK to our board default Jane...works.  Something in those two themes is causing problems..
Even after I cleared my cache it made no difference. Now all my users are using the jane theme..no problems

[Sir Osis of Liver]

Never seen this before, but kind of feels like a caching issue.  Curve bounces me back to theme 3 login, it drops the session when attempting to reply.  Core drops session, but continues to show user logged.  Have you tried clearing forum cache and disabling caching?  Is server running any caching?  What's in your .htaccess?

The certificate warning is most likely caused by not having the cert configured for www as well as non-www.  If you're using cpanel, you can check that in SSL/TLS Status.  That would cause problems for users who have old www bookmark.  Shouldn't have anything to do with the theme problem, but anything's possible (especially if it's bad).  You are using a Let's Encrypt cert, they made a change in Sept that caused problems for my forums, but nothing like this -

  https://letsencrypt.org/docs/dst-root-ca-x3-expiration-september-2021/

Your cert may have renewed recently and updated to newer version, that might explain why the glitch appeared from nowhere.  My host fixed it by switching to a cpanel cert.

[justuk]

Are you suggesting my hosting providers SSL is at fault here? And that my site is somehow unsafe? (unless I've misunderstood)

Right...I changed my theme to SMF default CORE theme... couldn't post.. changed it to CURVE same thing,,
Changed it BACK to our board default Jane...works.  Something in those two themes is causing problems..
Even after I cleared my cache it made no difference. Now all my users are using the jane theme..no problems

[Kindred]

justuk -- you're reacting, not reading ---     

Your certificate is either not configured correctly for your setup
-- You need to have a certificate set up for the ROOT domain (which includes all subdomains) *OR* you need to have a certificate set up for each and every subdomain -- and www is a subdomain.
OR
-- You need to configure your .htaccess to properly FORCE everyone into both https AND the subdomain that you expect your forum to use (either www or not www)

ONE of those things should happen....  it's up to you which one (although I would suggest the second)

Core is ancient, outdated and probably does not properly support some things....    honestly, unless you have someone willing to spend the time to debug, I would suggest just deleting the core theme entirely.

Curve is the default theme for SMF 2.0...   it's also the fall-back. If a custom theme does not have custom files defined, then the system uses the Curve (aka default) version of those files.  If Curve is failing, but your custom theme works -- that's great, your system can work for your users -- but you should figure out why Curve fails.

or, maybe, upgrade to 2.1.1 - which replaces everything - and then install mods one at a time until things break.

[Sir Osis of Liver]

We're using Core only for test purposes.  The original problem was session timeouts on login for some members.  Things have gone downhill since.  Custom theme works fine, but Curve bounces back to custom theme login.  Up until today, https://www.friendlychatting.co.uk/smf_2/ was being blocked by Kaspersky due to invalid certificate.  Allows me to view cert, it's configured for non-www.  Just now FF is giving me PR_CONNECT_RESET_ERROR, they must have changed something.  I would suggest fixing certificate first, then fix Curve.  Would not be comfortable upgrading this broken forum to 2.1 until it's working correctly.

Can try this in .htaccess -

Code Select Expand


# 301 REDIRECT HTTP TO HTTPS AND WWW TO NON-WWW
<IfModule mod_rewrite.c>
RewriteEngine On
RewriteCond %{HTTPS} off [OR]
RewriteCond %{HTTP_HOST} ^www\. [NC]
RewriteCond %{HTTP_HOST} ^(?:www\.)?(.+)$ [NC]
RewriteRule ^ https://%1%{REQUEST_URI} [L,NE,R=301]
</IfModule>



[justuk]

Broken? My forum is NOT broken! thanks a lot. thats going to encourage people to join isn't it!    Close this topic.

[Aleksi "Lex" Kilpinen]

I am sorry, but when something doesn't work right, then it is broken. And since you opened this topic, and described an issue, you should already know there is something broken somewhere. The people in this topic are only trying to help you figure it out - If you don't want the help, then that is your choice to make, but please, if you do want to get things corrected then try not to take it personally when someone tells you there is something wrong. It is not an accusation towards you or your host, it is simply an observation about your current install and meant to help you.

[Steve]

Jane, you really should take on board the advice given you. And Lex's response explains everything in a nutshell.

But I will mark this topic solved as you wish so that others who might otherwise help know they can skip this.