Staying Logged in
|
eslord1
Joined: 2004-12-21
Posts: 26 |
Posted: Fri, 2004-12-24 20:47
|
|
Ok, this is confusing now, I can stay logged in on other sites, but yet when I get logged in as the Site Administrator it somehow logs me out??? very strange. I have tested being logged in other places (including here) and I do not misteriously get logged out. I first thought it was a browser issue of mine, yet with those tests, there is something else. Maybe I dont have a permission set right on my site???? im confused... thanks Gallery URL (optional): gallery.stevenlord.com |
|
Posts: 8601
logs you out when?
Posts: 26
I wish I could give you a consistant time it did. Seems to log me out randomly, maybe its after a certain amount of time. Ill check into that.
Steven
Posts: 8601
k, i've noticed the same in the past week or so.. checking the code i see we now store the IP address in the session cookie.. do you have a dynamic IP address?
Posts: 26
Yes I do. I am on cable, but it changes daily it would seem. I just tried to log into my site using the main menu login (upper left login/password area) and when did it just came back to the main screen again and never logged me in. Very strange. I now can reproduce going into my admin area, click on a few settings and then POOF access denied error. I then go back to the gallery and im no longer logged in.
Posts: 314
I had this problem couple weeks ago (usually it happened after I ran into some bug and got PHP error), and clearing the cookies and/or Gallery cache got rid of the problem...
Posts: 26
Error (ERROR_PERMISSION_DENIED):
in file modules/core/classes/helpers/GalleryUserHelper_medium.class at line 207 (gallerystatus::error)
in file modules/core/classes/GalleryCoreApi.class at line 386 (galleryuserhelper_medium::assertsiteadministrator)
in file modules/core/AdminLayouts.inc at line 45 (gallerycoreapi::assertuserissiteadministrator)
in file main.php at line 170 (adminlayoutscontroller::handlerequest)
in file main.php at line 47
in file main.php at line 40
Hmm, I just reset the Gallery database back to scratch (ReInitializeGallery) then I also made sure I cleared out the cache. This is the error I just got while modifing the themes that were active.
Steven
Posts: 26
ReSetGallery - Done
This is what the installer just told me
- Missing files (2)
Note: You're running Gallery from CVS, so there might be some missing files. If you see this, please report it in the forums.
modules/core/test/phpunit/TemplateAudit.class
...dules/core/test/phpunit/UserPreferencesControllerTest2.class
Something I should do?
Steven
Posts: 26
Ok, this is the next error, Im done with this for now. Or maybe until someone gives me a clue in what direction I should take. Maybe a complete wipe and re-upload data?
Error (ERROR_PERMISSION_DENIED)
in modules/core/classes/helpers/GalleryUserHelper_medium.class at line 207 (gallerystatus::error)
in modules/core/classes/GalleryCoreApi.class at line 386 (galleryuserhelper_medium::assertsiteadministrator)
in modules/core/AdminLayouts.inc at line 45 (gallerycoreapi::assertuserissiteadministrator)
in main.php at line 170 (adminlayoutscontroller::handlerequest)
in main.php at line 47
in main.php at line 40
This is the last error, again I was modifying the theme's and got this wonderful error.
Im frustrated, dont get me wrong, but im not giving up, just need a breather and someone else's input ... thanks guys. Happy Holidays
Steven
Posts: 7994
Ok, try this. Edit modules/core/classes/GallerySession.class and find this block:
/* Verify the remote address to avoid casual session hijacking */ if (!isset($this->_remoteIp) || $this->_remoteIp != $_SERVER['REMOTE_ADDR']) { /* * The session was not created from this browser address, so reset * our data to prevent hijacking. */ $this->_remoteIp = $_SERVER['REMOTE_ADDR']; $this->_emptySessionData(); $ret = $this->save(true); if ($ret->isError()) { return $ret->wrap(__FILE__, __LINE__); } }(should start on line 152). Make a backup of this file, then just delete that chunk of code. Then see if you can reproduce the problem. If you can't reproduce it any more, then you're hitting the problem with your dynamic IP address. (We can fix that, but we have to figure out the best way, first)
Posts: 26
Ok, I tried to remove that section and it appeared to break the gallery (when I loaded my gallery I got the main.php code instead of my site) Maybe I did something wrong when I edited the file and removed the section. Although I now have another update. I can do almost everything else in my site, but when I go to the Theme's section, and try to turn on a theme, it then logs me out (or what appears to have happened). I again confirm that when I go back to my gallery, I am no longer logged in.
Thanks
Steven
Posts: 31
As a separate data point, I am on travel in Mexico and it appears my ISP uses a series of proxy servers which may randomly cause my IP to appear different to the web server. If I connect to my corporate VPN, I experience no problems. Directly connecting to my website causes lots of inconsistencies (almost with every request -- very frustraiting). Removing the code you mentioned, did solve this issue for me. At a minimum, being able to disable this code from an option in the Site Administration section would be a start, but since others may run into my situation, a better long term solution would be preferred.
Posts: 239
Looks like this did cause some immediate issues :cry:
Posts: 31
One option that came to mind would be... If you detect what may be session hijacking, you could present a special login screen that indicates the user's IP address has changed. On it, you could ask the user to login again and confirm that it is acceptable for their IP address to be changing. Security wise, it would do the same thing as you are trying to do now, force a new IP address to have to re-authenticate but would give the default option of being secure without an administrator knowing that certain of their users may fall into this situation.
Posts: 8601
maybe in site admin we could have a setting for IP netmask.. ie, only check the IP address comes from the same subnet or something? i'm just guessing that in these changing IP cases that only the last few bits of the IP may be changing.
Posts: 7994
I just improved that code so that it works better through proxies. This should reduce the problems you guys are seeing. I tested it with a couple of proxies and verified that it works ok for me. If you can still reproduce this problem, please let me know and I'll dig deeper.
Posts: 26
Ok, updating the code now, I will let you know if I can crash it more. Thanks
Steven
Posts: 26
Ok, I finished the upgrade (after doing a few other things as well, not site related) and broke it on the first try
I got this message
hijack! Array
(
[0] =>
[1] => 24.205.204.187
)
This was my current IP from my provider.
Steven
Posts: 87
cvs up, some debug code was accidentally left behing, this should now be fixed.
Posts: 26
Hmm, ok - CVS is done, now I get this
Security Violation The action you attempted is not permitted.
Back to the Gallery
Error Detail -
Error (ERROR_PERMISSION_DENIED) :
in modules/core/classes/helpers/GalleryUserHelper_medium.class at line 207 (gallerystatus::error)
in modules/core/classes/GalleryCoreApi.class at line 386 (galleryuserhelper_medium::assertsiteadministrator)
in modules/core/SiteAdmin.inc at line 46 (gallerycoreapi::assertuserissiteadministrator)
in modules/core/classes/GalleryView.class at line 246 (siteadminview::loadtemplate)
in main.php at line 257 (siteadminview::doloadtemplate)
in main.php at line 46
in main.php at line 39
PM me for the password and Ill be happy to let you look at it ...
Steven
Posts: 31
I've tried out the fix as well and it appears to be working correctly -- I don't get knocked out of my account. I don't know if this is related or not, but I am also receiving an ERROR_PERMISSION_DENIED trying to change permissions on one of my albums (this works on my other albums) -- to my knowledge, this did not occur prior to updating to the latest CVS.
Security Violation The action you attempted is not permitted.
Back to the Gallery
Error Detail -
Error (ERROR_PERMISSION_DENIED) :
in modules/core/classes/helpers/GalleryUserHelper_simple.class at line 68 (gallerystatus::error)
in modules/core/classes/GalleryCoreApi.class at line 319 (galleryuserhelper_simple::asserthasitempermission)
in modules/core/ItemPermissions.inc at line 313 (gallerycoreapi::asserthasitempermission)
in modules/core/ItemAdmin.inc at line 150 (itempermissionsview::loadtemplate)
in modules/core/classes/GalleryView.class at line 246 (itemadminview::loadtemplate)
in main.php at line 257 (itemadminview::doloadtemplate)
in main.php at line 46
in main.php at line 39
Posts: 7994
I just committed yet another fix. Now we don't look at the IP, we just key off of the browser's user agent string. This should be the same even if your IP changes. It's not as secure, but it'll be more reliable.
pospues, the error you're seeing is probably related to losing your session at an inopportune time. See if you can reproduce it with the latest code that uses the user agent as the security key.
Posts: 31
Updating to the latest CVS has apparently fixed the problem for me. I had been unable to reproduce any unexpected permission errors.
Posts: 26
All is well, Thanks!!! No more errors.
It would appear as though I may be able to help test re-implimenting verification via IP if you ever wanted/needed to re-add that feature.
Thanks again
Steven
Posts: 1
This causes another problem. If you are viewing other media than images (movies, panorama pictures with the applet) the user agent string changes. This makes impossible to view movies in the gallery and also makes it very annoying that you have to log in again every time you click on a movie link.
Posts: 7994
Argh! What a pain.
Ok, I've changed it yet again. Now we assume that it's not a hijack if either the user agent or the browser IP match. I verified that this allows the panorama applet to work (but I didn't test movies). Let me know what this breaks
Posts: 26
Hmm, Ill upload the new CVS when I get home. Is there anyway to use FFMPEG if PowWeb wont install the binary on their server? or better yet, is there any other program I can use to upload movies to the gallery and have them work???
Thanks
Steven
Posts: 8601
you don't need ffmpeg to upload movies.. it gives you the ability to create thumbnails for movies from the movie file. alternatives for thumbnail creation: use thumbnail module.. you can assign one thumbnail for all movies or upload a jpeg thumbnail for each movie.
Posts: 26
Wow, DUH! Ok, now I feel dumb. Thank you for pointing that out.
Never ceases to amaze me how much I like this script!