Admin logging is looping

Teta · Post by **Teta** » Sun May 13, 2007 4:52 pm

Hello,

I'm having a simple problem using serendipity. In fact, I've been playing with several webserver configuration on my own for my own pleasure and I've settled to use :

Apache 2.0... (not the latest)
PHP 5.2.2 (the latest)
MySQL 5... (the latest)

Edit :
Seredipity (downloaded yesterday)

Running on a winxp box because I'm masochist.

My problem is easy to describe and have been reported a few times on your forum :

When logging in the admin panel, I get to the admin page. When clicking a link on the admin page, I get back to the logging panel.

I found some situations similar and ensured that it didn't resolve my problem :
session.save_path
session_path is c:/program files/php/tmp/, a supposedly writable folder.
cookies issue
I've also tried both browser (IE and FF) on my laptop and the server itself. Both gave me unsussecfull attempt, while creating cookies in session_path.

I have a phpbb board installed (for the sake of veryfing my system was using MySQL properly and or the sake of testing the known issue with MySQL 5 by myself) which gives me proper output, so I'm quite confused at that point. Probably I missed a result in my search or I just am unable to properly configure it.

Thanks in advance for your benevolent check and program,

have a nice day!

Post by **mattsches** » Sun May 13, 2007 11:16 pm

Which version of Serendipity are you using?

Teta · Post by **Teta** » Sun May 13, 2007 11:18 pm

latest.

Post by **garvinhicking** » Mon May 14, 2007 4:23 pm

Hi!

Sadly, phpBB uses its own session management and not PHP sessions, so you can't compare them.

Did you check the mentioned session.save_path - if you login, do files get added there?

Which URL are you using to connect to your local apache? If possible, try the IP directly instead of "localhost", because browsers tend to ignore cookies that run on "localhost".

Regards,
Garvin

Post by **mattsches** » Mon May 14, 2007 6:13 pm

garvinhicking wrote:Which URL are you using to connect to your local apache? If possible, try the IP directly instead of "localhost", because browsers tend to ignore cookies that run on "localhost".

That's exactly what I was about to say

For more info, you might want to take a look at this thread, especially my code on top of page 4.

- Mattsches

Teta · Post by **Teta** » Mon May 14, 2007 9:54 pm

Thank you for your pointers, I'll give you feedback in a couple of hours.

PaulWade · Post by **PaulWade** » Tue May 15, 2007 10:59 pm

UPDATE:

Nevermind, problem solved. I'm new to PHP and I finally figured out what he was referring to above. I moved my session folder and changed php.ini and now everything is kosher.

Thanks.

=======================

Hi,

I'm having the same exact issue. Running on Windows Server 2003 R2, latest version of Serendipity downloaded today, latest version of PHP installed today, and latest version of MySQL installed today.

I keep getting sent back to the log in panel after clicking on any of the admin links.

Thanks,
Paul

Teta · Post by **Teta** » Thu May 17, 2007 8:33 am

session.save_path

As I said earlier : I have RWE access on the save_path. I moved it on C:/tmp/ to be sure. Files are created as this sequence is executed :

1) Opening http://cyanure/serendipity/serendipity_admin.php in firefox
->cookie creation (sounds like no session in it : serendipityAuthedUser|b:0;)
2) I'm in front of the login (as no session are in, I guess)
->cookie creation (sounds like my infos as well as unsalted md5... will eventually be changed as I doesn't like DB my pass to find them back ^^)

3)Let's try to add an entry (thanks for the french version) ;
->cookie creation (sounds like no session in it : serendipityAuthedUser|b:0;)

So I used my DNS to GET my page, no localhost or such, though my MySqlDB is on localhost, but you didn't ask for it. I used my IP on another try, same results. I also tried on the server machine itself, same results.

I read your code but I understood it was include in V1.2 ; if it isn't I guess I'd need a little class on the internal scheme of Serendipity since I can do delphi, c++ and java great but I've only fixed PHP scripts so I will look further only if you tell me it is something I've got to modify in the source.

I also am quite familiar with SVN so if there's a rev to use or something I'll gladly SVN it.

I liked the communauty feeling around here, thanks. As you saw ; I do this for the only purpose of setting my own web environment as this isn't part of my Computer Science university degree, so it often is delayed so don't be in a hurry or such to answer, and if I come to find a way to help I'll gladly do it ^^ (impertinnent to the subject but I guess it's always fun to get as a compliment and an offer)

Post by **garvinhicking** » Thu May 17, 2007 2:53 pm

Hi Teta!

When session files are created in your TMP directory with "authsedUser:b|0" it means, you are NOT having a valid login in that case...are you probably using some additional .htaccess password protection to your blog? That might interfer with s9y's login routines.

Any chance that you get your blog online, so we could access it? Then I could check out some HTTP headers, if you create me a s9y author login (maybe straight via database access, inserting a row into the serendipity_authors column with MD5 hash as password)

Usually it shouldn't be a problem with the s9y code itself, morea setup/cookie/browser/server issue. Patching the code might help, but let's first have some feedback about my questions.

I also am quite familiar with SVN so if there's a rev to use or something I'll gladly SVN it.

If you use the Snapshots provided on www.s9y.org you don'T really need to connect to SVN. If you want, though, look here: http://developer.berlios.de/projects/serendipity

HTH,
Garvin

Teta · Post by **Teta** » Thu May 17, 2007 3:58 pm

About the non logged state, I concur. I felt it was as such. I am not using my own htaccess (upon my own knowledge, technically)

I'll paste some httpd.conf line :

#
# AllowOverride controls what directives may be placed in .htaccess files.
# It can be "All", "None", or any combination of the keywords:
# Options FileInfo AuthConfig Limit
#
AllowOverride None

...

#
# AccessFileName: The name of the file to look for in each directory
# for additional configuration directives. See also the AllowOverride
# directive.
#
AccessFileName .htaccess

...

LoadModule dav_module modules/mod_dav.so
LoadModule dav_svn_module modules/mod_dav_svn.so
LoadModule authz_svn_module modules/mod_authz_svn.so

#
# this block is for each project
#
<Location /svn>
DAV svn
(the rest of my SVN settings)

...

serendipity/serendipity @ zasz.dyndns.org:8080/serendipity

I indeed am reluctant to modify code that is meant to be general and working for everyone to cover an inner problem I can't see, but I won't be too much annoying to you if you indeed think it is the only way for it to work. I am usually looking forward to elicitate every step in me problem resolution for further reasearch from other users/documentation, as it is often usefull and it is a contribution that is usefull to the open source community

Post by **garvinhicking** » Fri May 18, 2007 9:00 pm

Hi!

Your PHP session cookie gets set to:

Code: Select all

Set-Cookie: PHPSESSID=6jk4hu2g7vnnebagk276j9scu7; path=\

That is an invalid path! It should either not have the 'Path' attribute, or use '/' as path.

Check your session.* settings in php.ini, there you can configure the session.cookie_path to a valid value.

Best regards,
Garvin