Login Looping

[asmecher]

Hi Rich,

No problem. It's client-side, and the process for inspecting cookies will depend on your browser... For Chrome, for example, see http://support.google.com/chrome/bin/answer.py?hl=en&answer=95647.

Regards,
Alec Smecher
Public Knowledge Project Team

[radjr]

Finally found the cookie. Was looking for something from the domain..not from Simon Frasier!

(nuked)

[radjr]

Hi Alec-
This is from Chrome...

Name: OJSSID
Content: (nuked)
Domain: http://www.wmpllc.org
Path: /ojs-2.4.1/
Send for: Any kind of connection
Accessible to script: Yes
Created: Friday, March 1, 2013 6:19:54 PM
Expires: When the browsing session ends

I am getting to do all the tech things I loved to do years ago!

[asmecher]

Hi Rich,

Be careful posting cookie contents as well; if they move quickly that'll potentially give someone else access to your active session. I've removed the relevant contents of the cookies. The relevant cookies will come from your domain, not ours; the last one you posted is relevant. Is that the only cookie you see from your domain?

Regards,
Alec Smecher
Public Knowledge Project Team

[radjr]

That was it under Chrome. I do remember another file starting in PHP in the same directory as the IE cookies..but it is gone.

Bottom line is if I delete the cookies, the login works fine. Not sure that helps you as I don't understand the coding it the cookie.

[asmecher]

Hi radjr,

I'm running out of ideas for remote debugging, unfortunately. Could you PM me with a URL and unpriveleged credentials for the journal?

Regards,
Alec Smecher
Public Knowledge Project Team

[radjr]

Hi Alec-

PM? Please define. Do you want ssh access to the server? Or something else.

Also per the PKP Frequently asked questions file. I inserted the "echo "Importing " . $class . "<br/>\n";" in the functions.inc.php file.

The last few lines that are displayed when trying to log in are :
Importing classes.security.Role
Importing classes.journal.JournalDAO
Importing classes.journal.Journal

So, per the FAQ it is stopping at journal.Journal?

Let me know how and what you want for credentials above.
And, many thanks for your time!

[asmecher]

Hi Rich,

Ah -- that modification to display the import may well be causing the login/logout problem, as it's resulting in content getting displayed before the cookie code gets a chance to initialize your session. Try removing that first.

Regards,
Alec Smecher
Public Knowledge Project Team

[radjr]

Alec-
See PM for details.

I added the debug statements as a way to debug and get you more info. The problem was happening way before the debug statement was added. Sorry.

[radjr]

I have removed the statement from the functions.inc.php for your review. The problem still occurs. Deleting the cookie on the local browser solves the problem in IE and Chrome.

Cheers!

[asmecher]

Hi Rich,

It looks like your session.auto_start setting is on in php.ini; that prevents OJS from properly configuring the session. I suspect if you look in your error logs you'll find warnings like this one that make it a bit easier to debug than just working from the symptoms.

The session.auto_start variable is unusual to see enabled, so I wonder if it's been turned on for another application on your server. Depending on your server configuration, you may be able to override it using a .htaccess directive -- however, it's not possible to change that configuration option from within OJS, since PHP will already be initialized before any of that code is run.

Regards,
Alec Smecher
Public Knowledge Project Team

[radjr]

Now I am confused..the php.ini file in /wmpllc.org/etc/php.ini shows the session.auto_start = 0

Are you looking at another php.ini file?

[Session]
session.bug_compat_42 = Off
session.auto_start = 0
session.cache_limiter = nocache
session.bug_compat_warn = Off
session.hash_function = 0
url_rewriter.tags = "a=href,area=href,frame=src,input=src,form=fakeentry"
session.name = PHPSESSID
session.use_only_cookies = 1
session.entropy_length = 0
session.serialize_handler = php
session.cookie_path = /
session.entropy_file =
session.gc_probability = 1
session.cache_expire = 180
session.gc_divisor = 1000
session.cookie_domain =
session.cookie_httponly =
session.gc_maxlifetime = 1440
session.referer_check =
session.save_handler = files
session.save_path = "/var/lib/php/session"
session.cookie_lifetime = 0
session.use_cookies = 1
session.use_trans_sid = 0
session.hash_bits_per_character = 5

[asmecher]

Hi Rich,

Looking a Site Administration > System Information > Extended PHP Information, it shows as...

Code: Select all

Directive             Local Value   Master Value
session.auto_start    On            Off

The master value indicates your main php.ini file has it set to "off", but somewhere else (e.g. a .htaccess override) it's been enabled.

Regards,
Alec Smecher
Public Knowledge Project Team

[radjr]

Seems that Plesk automatically sets the Session.auto_start=1

We are trying to get it turned off as there is no other .htaccess files anywhere else on this VPS. More in a few minutes. Thanks for your help Alec.

[radjr]

Seems that there are other packages that may turn this on..and no way to turn off the local Session.auto_start. So this is not going to run this way.

All this over cookies?