Serendipity Forums

Posted: **Tue Mar 18, 2008 1:38 pm**

Hiho,

I have the same problem as Zugschlus has, so he is not the only one

I don't think this is a PHP-related problem, more maybe a speciality of our s9y-installations, but I don't know why. Is there a good place to put a vardump() somewhere to see more debug-stuff? I can give you a login to my blog if you want to...

Posted: **Tue Mar 18, 2008 1:54 pm**

Hi!

I have the same problem as Zugschlus has, so he is not the only one

Did you check what your common denominators are? Maybe both using suhosin? Both using the same server setup, or Konqueror version?

I don't think this is a PHP-related problem, more maybe a speciality of our s9y-installations, but I don't know why. Is there a good place to put a vardump() somewhere to see more debug-stuff? I can give you a login to my blog if you want to...

Sadly I cannot spend much of my free time for such specific debugging tasks (I already spent 2 hours on this thread)...however, the whole session stuff is capsulated in serendipity_config.inc.php and include/functions_config.inc.php, so you can add your debuging/vardump routines there.

Best regards,
Garvin

Posted: **Tue Mar 18, 2008 6:18 pm**

Just for the record, kazehakase has just joined the not-so-exclusive club where the issue shows - I get thrown back to the login screen as soon as I try do to something in the admin frontend.

I'll find myself blogging with SQL statements in phpmyadmin soon, I fear.

Posted: **Tue Mar 18, 2008 9:27 pm**

Hi!

Zugschlus wrote:Just for the record, kazehakase has just joined the not-so-exclusive club where the issue shows - I get thrown back to the login screen as soon as I try do to something in the admin frontend.

You know that there are a multitude of other possible ways this can happen?

1. Wrong session.save_path
2. Your browser not accepting cookies
3. A mismatching session.cookie_domain
4. A firewall or extension blocking cookies
5. A domain name mismatch, like http://Yourblog.de != http://www.yourblog.de/
6. Suhosin blocking cookies or ignoring/filtering HTTP requests
7. Load balancing servers without shared sessions
8. Out of disk space for your browser cookie storage location
9. Using http://127.0.0.1 or other ip adresses, where browser often do not store cookies
10. A stored s9y pre 1.1 session cookie that did not get deleted before upgrading

And maybe even others things that have been mentioned. It thus does not necessarily imply that anyone who has login problems has that heisenbug you refer to

I'll find myself blogging with SQL statements in phpmyadmin soon, I fear.

What about suhosin?

Regards,
Garvin

Posted: **Tue Mar 18, 2008 9:59 pm**

garvinhicking wrote:
Zugschlus wrote:Just for the record, kazehakase has just joined the not-so-exclusive club where the issue shows - I get thrown back to the login screen as soon as I try do to something in the admin frontend.
You know that there are a multitude of other possible ways this can happen?

No, how could I? I do not have any clue about PHP programming whatsoever.

garvinhicking wrote: 1. Wrong session.save_path

Unset in php.ini. I guess it defaults to /var/lib/php5 then since that's where new sess_foo files appear. 2.8 Gig free, 99 % inodes free.

It has always been that way here.

garvinhicking wrote: 2. Your browser not accepting cookies

The Live Headers prove that Iceweasel accepts and sends back the cookies. Did you even look at them?

garvinhicking wrote: 3. A mismatching session.cookie_domain

Empty in php.ini. It has always been that way.

garvinhicking wrote: 4. A firewall or extension blocking cookies

No firewall in place, and if an extension were blocking cookies, one wouldn't see them being sent back to the server in Live Headers, and _no_ cookie-based application would work. s9y is the only app acting up.

garvinhicking wrote: 5. A domain name mismatch, like http://Yourblog.de !=
http://www.yourblog.de/

The blog has only one host name, blog.zugschlus.de. The Live Header show that that's the only host name being accessed.

garvinhicking wrote: 6. Suhosin blocking cookies or ignoring/filtering HTTP requests

As the Debian PHP maintainers have confirmed, it doesn't in the default configuration (which I haven't changed).

garvinhicking wrote: 7. Load balancing servers without shared sessions

No, it's a single box.

garvinhicking wrote: 8. Out of disk space for your browser cookie storage location

> 1 Gig free. Additionally, this would break all applications using cookies, and not only s9y.

garvinhicking wrote: 9. Using http://127.0.0.1 or other ip adresses, where browser often do not store cookies

See Live Headers.

garvinhicking wrote: 10. A stored s9y pre 1.1 session cookie that did not get deleted before upgrading

In the past, browser cookies were deleted on a regular basis as this sometimes helps resolving the s9y issue.

garvinhicking wrote: And maybe even others things that have been mentioned. It thus does not necessarily imply that anyone who has login problems has that heisenbug you refer to

I never said that. Accidentally I know that Rince has exactly the same issue. Only that deleting _his_ cookies still helps.

garvinhicking wrote:
I'll find myself blogging with SQL statements in phpmyadmin soon, I fear.
What about suhosin?

I do not feel myself in a position currently to upgrade a production web server system to an unsupported PHP version.

How much will it cost to motivate you? Please give me your bank account data.

Greetings
Marc

Posted: **Tue Mar 18, 2008 10:22 pm**

hi guys,

I know how frustrated Zugschlus is right now, and I think that Garvin just wants to check all possible solutions - especially since I know a lot of End-Users with Root-servers who wouldn't check these things.

But I know that Zugschlus wouldn't ask if it would be something that easy, especially since he tries now all possible browsers - most (if not all?) with the same result. And since he is a good sysadmin he knows to avoid the usual problems - like full filesystem, not writable directories for cookies and so on.

I don't think the question is wether it works with the latest version of php and the bleeding edge - the problem is to identify the reason for the strange behaviour. Without identifying the problem source no one can find a solution - wether it is a bug in PHP, something in the logn/session-logic in s9y or just a glitch in the system.

Therefore the question: is there a way to get more debug-output out of the login/session-stuff from s9y to see what is going wrong there?

Posted: **Tue Mar 18, 2008 10:36 pm**

Hi!

No, how could I?

Just because you were referring to other people joining the club; but IMHO it's still rather exclusive

Unset in php.ini. I guess it defaults to /var/lib/php5 then since that's where new sess_foo files appear. 2.8 Gig free, 99 % inodes free.

It has always been that way here.

Despite of that, can you try if setting the sessoin.save_path to a value makes any change?

The Live Headers prove that Iceweasel accepts and sends back the cookies. Did you even look at them?

I was talking generally here. I know a LOT of those things do not apply to you. I was refering to that Hashcat you mentioned.

I do not feel myself in a position currently to upgrade a production web server system to an unsupported PHP version.

Oh, you can'T reproduce it in the VMWare VM? There you could try to remove suhosin?

How much will it cost to motivate you?

I believe it would cost too much; since I would need to reproduce the issue, I would need to come to you where your client is located to try things exactly where they happen and can at least be somehow reproduced (even if it's sporadically). For things like that I either charge through my own business (50 E/hour) or through my company (72 E/hour). Work through the company has the added benefit of being contract work, whereas my private business has no insurance.

If at least it were possible for me to reproduce it somewhere, I could at least try to check everything frmo the s9y end of it.

Disabling suhosin would be a more feasible option at the current point.

I'm quite sure I get off as really rude here, BUT: First I understand your angriness, Zugschlus. Having something sporadically occur drives me nuts as well. As much as I would love to offer free help here, also to maybe fix s9y if there's something to fix - my problem is that I only have limited time in my life dealing with Serendipity. And irreproducable issues like this tend to eat away time a lot. A lot. A lot. And that is something I can hardly affort because there are also other s9y issues (like new releases, security fixes, forum support, customer support) that I need to address. Additionally, every once in a while, I need some time for my own&real life. This is why I'm issuing statements here that sound reluctant or that might make the impression that I wouldn't care.

In fact, I do care - a lot. But I simply need to manage my time here, messing with an issue that is so hard to fix. And now I'm repeating myself and stopping here.

Best regards,
Garvin

Posted: **Tue Mar 18, 2008 11:21 pm**

And something good to debug:

I just made a debug-session with a good friend of mine regarding php-stuff:

I checked the content of the cookie-content on the webserver.
After just looking on the blog, I got a new cookie with the following content:

Code: Select all

sudo more /var/lib/php5/sess_fc4c10b03f7026f805a03a47a7d29e9e
SERVER_GENERATED_SID|b:1;serendipityLanguage|s:2:"de";serendipityAuthedUser|b:0;no_smarty|N;HTTP_REFERER|s:21:"http://blog.rince.de/

Then I logged myself in and the cookie-content changed:

Code: Select all

rince@ivanova:/home/rince-blog-rince-de/apache/etc/php5$ sudo more /var/lib/php5/sess_fc4c10b03f7026f805a03a47a7d29e9e SERVER_GENERATED_SID|b:1;no_smarty|N;serendipityLanguage|s:2:"de";author_token|s:40:"57906bb9cf5002a45b0d8a98db7662f3a773060e";serendipityUser|s:5:"Rince";serendipityRealname|s:5:"rince";serendipityPassword|s:32:"x";serendipityEmail|s:15:"wagner@rince.de";serendipityAuthorid|s:1:"1";serendipityUserlevel|s:3:"255";serendipityAuthedUser|b:1;serendipityRightPublish|s:1:"1";

(I changed the content of s:32)

After trying to enter a new blog entry, I came back to the login-screen. The Cookie-content now was:

Code: Select all

rince@ivanova:/home/rince-blog-rince-de/apache/etc/php5$ sudo more /var/lib/php5/sess_fc4c10b03f7026f805a03a47a7d29e9e
SERVER_GENERATED_SID|b:1;no_smarty|N;

So, somehow that cookie got changed or invalidated. But I don't know how.

Is this helpful?

Posted: **Tue Mar 18, 2008 11:28 pm**

Hi!

Your debugging session would be more helpful if you also had the HTTP headers. I suppose that a X-Session-Reinit: True might have been emitted when the cookie got purged?

The only way session data can be removed is when the serendipity_session_destroy() function is called, or the PHP function session_destroy().

This can only happen if serendipity_authenticate_author fails. Hm. s9y stores its cookie toknes in the serendipity_options table. Check if the layout of your options table is the one that comes with the default sql/db.sql layout? Maybe your tokens cannot be matched because this table is garbaged or differing...?

Truncating the DB table serendipity_options could be helpful in this case. I should've thought of this one before, as well. Make a backup of the data though, because also template options are stored in that table (if you use a template that comes with options). Only the '%okey%' values actually contain session tokens.

The other way this can happen if the Cookie token mismatches the last Session Token - this can also either be caused by a bad serendipity_options table or by mismatching PHP sessions. (see serendipity_admin.php)

HTH,
Garvin

Posted: **Wed Mar 19, 2008 12:02 am**

Good evening

Now I also have the life headers:

First: Just open the page http://blog.rince.de/

Code: Select all

http://blog.rince.de/

GET / HTTP/1.1
Host: blog.rince.de
User-Agent: Mozilla/5.0 (Macintosh; U; Intel Mac OS X; de; rv:1.8.1.12) Gecko/20080201 Firefox/2.0.0.12
Accept: text/xml,application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5
Accept-Language: de-de,de;q=0.8,en-us;q=0.5,en;q=0.3
Accept-Encoding: gzip,deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 300
Connection: keep-alive
Cookie: PHPSESSID=dc2279ad1ad90e3473f5e4ec5e2ce06c; serendipity[karmaVote]=a%3A0%3A%7B%7D

HTTP/1.x 200 OK
Date: Tue, 18 Mar 2008 22:32:00 GMT
Server: Apache/2.2.3 (Debian) PHP/5.2.0-8+etch10
X-Powered-By: PHP/5.2.0-8+etch10
Expires: 0
Cache-Control: no-cache, pre-check=0, post-check=0
Pragma: no-cache
X-Serendipity-InterfaceLangSource: Content-Negotiation
X-Serendipity-InterfaceLang: de
X-Blog: Serendipity
Content-Type: text/html; charset=UTF-8
Via: 1.1 blog.rince.de
Keep-Alive: timeout=15, max=100
Connection: Keep-Alive
Transfer-Encoding: chunked
----------------------------------------------------------
http://blog.rince.de/plugin/checkautobackup

GET /plugin/checkautobackup HTTP/1.1
Host: blog.rince.de
User-Agent: Mozilla/5.0 (Macintosh; U; Intel Mac OS X; de; rv:1.8.1.12) Gecko/20080201 Firefox/2.0.0.12
Accept: image/png,*/*;q=0.5
Accept-Language: de-de,de;q=0.8,en-us;q=0.5,en;q=0.3
Accept-Encoding: gzip,deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 300
Connection: keep-alive
Referer: http://blog.rince.de/
Cookie: PHPSESSID=dc2279ad1ad90e3473f5e4ec5e2ce06c; serendipity[karmaVote]=a%3A0%3A%7B%7D

HTTP/1.x 200 OK
Date: Tue, 18 Mar 2008 22:32:01 GMT
Server: Apache/2.2.3 (Debian) PHP/5.2.0-8+etch10
X-Powered-By: PHP/5.2.0-8+etch10
Expires: 0
Cache-Control: no-cache, pre-check=0, post-check=0
Pragma: no-cache
X-Serendipity-InterfaceLangSource: Content-Negotiation
X-Serendipity-InterfaceLang: de
X-Blog: Serendipity
Content-Length: 0
Content-Type: text/html; charset=UTF-8
Via: 1.1 blog.rince.de
Keep-Alive: timeout=15, max=99
Connection: Keep-Alive
----------------------------------------------------------

The Cookie has the following content:

Code: Select all

sudo more /var/lib/php5/sess_dc2279ad1ad90e3473f5e4ec5e2ce06c
SERVER_GENERATED_SID|b:1;serendipityLanguage|s:2:"de";serendipityAuthedUser|b:0;no_smarty|N;HTTP_REFERER|s:21:"http://blog.rince.de/
";

Then I log myself in:

Code: Select all

http://blog.rince.de/admin

GET /admin HTTP/1.1
Host: blog.rince.de
User-Agent: Mozilla/5.0 (Macintosh; U; Intel Mac OS X; de; rv:1.8.1.12) Gecko/20080201 Firefox/2.0.0.12
Accept: text/xml,application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5
Accept-Language: de-de,de;q=0.8,en-us;q=0.5,en;q=0.3
Accept-Encoding: gzip,deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 300
Connection: keep-alive
Referer: http://blog.rince.de/
Cookie: PHPSESSID=dc2279ad1ad90e3473f5e4ec5e2ce06c; serendipity[karmaVote]=a%3A0%3A%7B%7D

HTTP/1.x 302 Found
Date: Tue, 18 Mar 2008 22:32:16 GMT
Server: Apache/2.2.3 (Debian) PHP/5.2.0-8+etch10
X-Powered-By: PHP/5.2.0-8+etch10
Expires: 0
Cache-Control: no-cache, pre-check=0, post-check=0
Pragma: no-cache
X-Serendipity-InterfaceLangSource: Content-Negotiation
X-Serendipity-InterfaceLang: de
X-Blog: Serendipity
Location: http://blog.rince.de/serendipity_admin.php
Content-Length: 0
Content-Type: text/html; charset=UTF-8
Via: 1.1 blog.rince.de
Keep-Alive: timeout=15, max=100
Connection: Keep-Alive
----------------------------------------------------------

http://blog.rince.de/serendipity_admin.php

GET /serendipity_admin.php HTTP/1.1
Host: blog.rince.de
User-Agent: Mozilla/5.0 (Macintosh; U; Intel Mac OS X; de; rv:1.8.1.12) Gecko/20080201 Firefox/2.0.0.12
Accept: text/xml,application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5
Accept-Language: de-de,de;q=0.8,en-us;q=0.5,en;q=0.3
Accept-Encoding: gzip,deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 300
Connection: keep-alive
Referer: http://blog.rince.de/
Cookie: PHPSESSID=dc2279ad1ad90e3473f5e4ec5e2ce06c; serendipity[karmaVote]=a%3A0%3A%7B%7D

HTTP/1.x 200 OK
Date: Tue, 18 Mar 2008 22:32:17 GMT
Server: Apache/2.2.3 (Debian) PHP/5.2.0-8+etch10
X-Powered-By: PHP/5.2.0-8+etch10
Expires: Thu, 19 Nov 1981 08:52:00 GMT
Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0
Pragma: no-cache
X-Serendipity-InterfaceLangSource: Content-Negotiation
X-Serendipity-InterfaceLang: de
Content-Length: 4205
Content-Type: text/html; charset=UTF-8
Via: 1.1 blog.rince.de
Keep-Alive: timeout=15, max=99
Connection: Keep-Alive
----------------------------------------------------------

http://blog.rince.de/serendipity_admin.css

GET /serendipity_admin.css HTTP/1.1
Host: blog.rince.de
User-Agent: Mozilla/5.0 (Macintosh; U; Intel Mac OS X; de; rv:1.8.1.12) Gecko/20080201 Firefox/2.0.0.12
Accept: text/css,*/*;q=0.1
Accept-Language: de-de,de;q=0.8,en-us;q=0.5,en;q=0.3
Accept-Encoding: gzip,deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 300
Connection: keep-alive
Referer: http://blog.rince.de/serendipity_admin.php
Cookie: PHPSESSID=dc2279ad1ad90e3473f5e4ec5e2ce06c; serendipity[karmaVote]=a%3A0%3A%7B%7D

HTTP/1.x 200 OK
Date: Tue, 18 Mar 2008 22:32:17 GMT
Server: Apache/2.2.3 (Debian) PHP/5.2.0-8+etch10
X-Powered-By: PHP/5.2.0-8+etch10
Expires: Tue, 18 Mar 2008 23:32:17 GMT
X-Serendipity-InterfaceLangSource: Content-Negotiation
X-Serendipity-InterfaceLang: de
X-Blog: Serendipity
Content-Length: 6292
Content-Type: text/css; charset=UTF-8
Via: 1.1 blog.rince.de
Keep-Alive: timeout=15, max=100
Connection: Keep-Alive
----------------------------------------------------------

http://blog.rince.de/templates/default/admin/pluginmanager.css

GET /templates/default/admin/pluginmanager.css HTTP/1.1
Host: blog.rince.de
User-Agent: Mozilla/5.0 (Macintosh; U; Intel Mac OS X; de; rv:1.8.1.12)Gecko/20080201 Firefox/2.0.0.12
Accept: text/css,*/*;q=0.1
Accept-Language: de-de,de;q=0.8,en-us;q=0.5,en;q=0.3
Accept-Encoding: gzip,deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 300
Connection: keep-alive
Referer: http://blog.rince.de/serendipity_admin.php
Cookie: PHPSESSID=dc2279ad1ad90e3473f5e4ec5e2ce06c; serendipity[karmaVote]=a%3A0%3A%7B%7D

HTTP/1.x 200 OK
Date: Tue, 18 Mar 2008 22:32:17 GMT
Server: Apache/2.2.3 (Debian) PHP/5.2.0-8+etch10
Last-Modified: Thu, 01 Jun 2006 11:18:53 GMT
Etag: "27870-3f4-d547c140"
Accept-Ranges: bytes
Content-Length: 1012
Content-Type: text/css
Via: 1.1 blog.rince.de
Keep-Alive: timeout=15, max=99
Connection: Keep-Alive
----------------------------------------------------------

http://blog.rince.de/templates/carl_contest/admin/img/background.png

GET /templates/carl_contest/admin/img/background.png HTTP/1.1
Host: blog.rince.de
User-Agent: Mozilla/5.0 (Macintosh; U; Intel Mac OS X; de; rv:1.8.1.12) Gecko/20080201 Firefox/2.0.0.12
Accept: image/png,*/*;q=0.5
Accept-Language: de-de,de;q=0.8,en-us;q=0.5,en;q=0.3
Accept-Encoding: gzip,deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 300
Connection: keep-alive
Referer: http://blog.rince.de/serendipity_admin.css
Cookie: PHPSESSID=dc2279ad1ad90e3473f5e4ec5e2ce06c; serendipity[karmaVote]=a%3A0%3A%7B%7D

HTTP/1.x 200 OK
Date: Tue, 18 Mar 2008 22:32:18 GMT
Server: Apache/2.2.3 (Debian) PHP/5.2.0-8+etch10
Last-Modified: Wed, 08 Feb 2006 16:35:26 GMT
Etag: "278bc-1f0-15488f80"
Accept-Ranges: bytes
Content-Length: 496
Content-Type: image/png
Via: 1.1 blog.rince.de
Keep-Alive: timeout=15, max=98
Connection: Keep-Alive
----------------------------------------------------------

http://blog.rince.de/templates/carl_contest/admin/img/infobar_background.png

GET /templates/carl_contest/admin/img/infobar_background.png HTTP/1.1
Host: blog.rince.de
User-Agent: Mozilla/5.0 (Macintosh; U; Intel Mac OS X; de; rv:1.8.1.12) Gecko/20080201 Firefox/2.0.0.12
Accept: image/png,*/*;q=0.5
Accept-Language: de-de,de;q=0.8,en-us;q=0.5,en;q=0.3
Accept-Encoding: gzip,deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 300
Connection: keep-alive
Referer: http://blog.rince.de/serendipity_admin.css
Cookie: PHPSESSID=dc2279ad1ad90e3473f5e4ec5e2ce06c; serendipity[karmaVote]=a%3A0%3A%7B%7D

HTTP/1.x 200 OK
Date: Tue, 18 Mar 2008 22:32:18 GMT
Server: Apache/2.2.3 (Debian) PHP/5.2.0-8+etch10
Last-Modified: Wed, 08 Feb 2006 16:35:26 GMT
Etag: "278bd-fc-15488f80"
Accept-Ranges: bytes
Content-Length: 252
Content-Type: image/png
Via: 1.1 blog.rince.de
Keep-Alive: timeout=15, max=98
Connection: Keep-Alive
----------------------------------------------------------

http://blog.rince.de/templates/carl_contest/admin/img/button_background.png

GET /templates/carl_contest/admin/img/button_background.png HTTP/1.1
Host: blog.rince.de
User-Agent: Mozilla/5.0 (Macintosh; U; Intel Mac OS X; de; rv:1.8.1.12)Gecko/20080201 Firefox/2.0.0.12
Accept: image/png,*/*;q=0.5
Accept-Language: de-de,de;q=0.8,en-us;q=0.5,en;q=0.3
Accept-Encoding: gzip,deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 300
Connection: keep-alive
Referer: http://blog.rince.de/serendipity_admin.css
Cookie: PHPSESSID=dc2279ad1ad90e3473f5e4ec5e2ce06c; serendipity[karmaVote]=a%3A0%3A%7B%7D

HTTP/1.x 200 OK
Date: Tue, 18 Mar 2008 22:32:18 GMT
Server: Apache/2.2.3 (Debian) PHP/5.2.0-8+etch10
Last-Modified: Wed, 08 Feb 2006 16:35:26 GMT
Etag: "278be-880-15488f80"
Accept-Ranges: bytes
Content-Length: 2176
Content-Type: image/png
Via: 1.1 blog.rince.de
Keep-Alive: timeout=15, max=97
Connection: Keep-Alive
----------------------------------------------------------

http://blog.rince.de/serendipity_admin.php

POST /serendipity_admin.php HTTP/1.1
Host: blog.rince.de
User-Agent: Mozilla/5.0 (Macintosh; U; Intel Mac OS X; de; rv:1.8.1.12) Gecko/20080201 Firefox/2.0.0.12
Accept: text/xml,application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5
Accept-Language: de-de,de;q=0.8,en-us;q=0.5,en;q=0.3
Accept-Encoding: gzip,deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 300
Connection: keep-alive
Referer: http://blog.rince.de/serendipity_admin.php
Cookie: PHPSESSID=dc2279ad1ad90e3473f5e4ec5e2ce06c; serendipity[karmaVote]=a%3A0%3A%7B%7D
Content-Type: application/x-www-form-urlencoded
Content-Length: 104
serendipity%5Baction%5D=admin&serendipity%5Buser%5D=xxx&serendipity%5Bpass%5D=zzz&submit=Login+%3

HTTP/1.x 200 OK
Date: Tue, 18 Mar 2008 22:32:26 GMT
Server: Apache/2.2.3 (Debian) PHP/5.2.0-8+etch10
X-Powered-By: PHP/5.2.0-8+etch10
Expires: Thu, 19 Nov 1981 08:52:00 GMT
Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0
Pragma: no-cache
X-Serendipity-InterfaceLangSource: Content-Negotiation
X-Serendipity-InterfaceLang: de
Content-Type: text/html; charset=UTF-8
Set-Cookie: serendipity[old_session]=dc2279ad1ad90e3473f5e4ec5e2ce06c;
expires=Thu, 17-Apr-2008 22:32:26 GMT; path=/; domain=127.0.0.1:1113
Set-Cookie: serendipity[author_token]=761fc0c2fd89d9ab000243d9a3f3304c114746c8; expires=Thu, 17-Apr-2008 22:32:26 GMT; path=/; domain=127.0.0.1
Set-Cookie: serendipity[userDefLang]=de; expires=Thu, 17-Apr-2008 22:32:26 GMT; path=/; domain=127.0.0.1:1113
Set-Cookie: serendipity[author_information]=deleted; expires=Mon, 19-Mar-2007 22:32:25 GMT; path=/; domain=127.0.0.1
Set-Cookie: serendipity[author_information_iv]=deleted; expires=Mon, 19-Mar-2007 22:32:25 GMT; path=/; domain=127.0.0.1
Via: 1.1 blog.rince.de
Keep-Alive: timeout=15, max=97
Connection: Keep-Alive
Transfer-Encoding: chunked
----------------------------------------------------------

The Cookie shows the following content:

Code: Select all

sudo more /var/lib/php5/sess_dc2279ad1ad90e3473f5e4ec5e2ce06c
SERVER_GENERATED_SID|b:1;no_smarty|N;serendipityLanguage|s:2:"de";serendipityAuthedUser|b:1;HTTP_REFERER|s:42:"http://blog.rince.de/
serendipity_admin.php";author_token|s:40:"761fc0c2fd89d9ab000243d9a3f3304c114746c8";serendipityUser|s:5:"xxx";serendipityRealname|
s:5:"rince";serendipityPassword|s:32:"x";serendipityEmail|s:15:"foo@bar";serendipityAuthorid|
s:1:"1";serendipityUserlevel|s:3:"255";serendipityRightPublish|s:1:"1";

And now I try to enter an entry and get logged out:

Code: Select all

http://blog.rince.de/serendipity_admin.php?serendipity[adminModule]=entries&serendipity[adminAction]=new

GET /serendipity_admin.php?serendipity[adminModule]=entries&serendipity[adminAction]=new HTTP/1.1
Host: blog.rince.de
User-Agent: Mozilla/5.0 (Macintosh; U; Intel Mac OS X; de; rv:1.8.1.12) Gecko/20080201 Firefox/2.0.0.12
Accept: text/xml,application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5
Accept-Language: de-de,de;q=0.8,en-us;q=0.5,en;q=0.3
Accept-Encoding: gzip,deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 300
Connection: keep-alive
Referer: http://blog.rince.de/serendipity_admin.php
Cookie: PHPSESSID=dc2279ad1ad90e3473f5e4ec5e2ce06c; serendipity[karmaVote]=a%3A0%3A%7B%7D

HTTP/1.x 200 OK
Date: Tue, 18 Mar 2008 22:32:42 GMT
Server: Apache/2.2.3 (Debian) PHP/5.2.0-8+etch10
X-Powered-By: PHP/5.2.0-8+etch10
Expires: Thu, 19 Nov 1981 08:52:00 GMT
Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0
Pragma: no-cache
X-Serendipity-InterfaceLangSource: Content-Negotiation
X-Serendipity-InterfaceLang: de
Content-Length: 4205
Content-Type: text/html; charset=UTF-8
Set-Cookie: serendipity[old_session]=dc2279ad1ad90e3473f5e4ec5e2ce06c; expires=Thu, 17-Apr-2008 22:32:42 GMT; path=/; domain=blog.rince.de
Set-Cookie: serendipity[userDefLang]=de; expires=Thu, 17-Apr-2008 22:32:42 GMT; path=/; domain=blog.rince.de
Via: 1.1 blog.rince.de
Keep-Alive: timeout=15, max=100
Connection: Keep-Alive
----------------------------------------------------------

And the Cookie-Content is as followed:

Code: Select all

sudo more /var/lib/php5/sess_dc2279ad1ad90e3473f5e4ec5e2ce06c
SERVER_GENERATED_SID|b:1;no_smarty|N;

(I changed the sensible parts of the second cookie, like username, Password and mailaddress).

Posted: **Wed Mar 19, 2008 6:49 am**

Well, I don't know whether different s9y versions may be playing a role in here, but since rince's blog shows Serendipity 1.2 and Marc's a (yet unknown to me version) Serendipity 1.2.2...

FWIW,
Freudi

Posted: **Wed Mar 19, 2008 8:19 am**

Freudi: yes - but we hunt the same problem. After logging in I try to make an entry and I get a login-screen. The question is why.

Posted: **Wed Mar 19, 2008 12:32 pm**

Freudi wrote:Well, I don't know whether different s9y versions may be playing a role in here, but since rince's blog shows Serendipity 1.2 and Marc's a (yet unknown to me version) Serendipity 1.2.2...

My s9y is tracking stable svn.

Greetings
Marc

Posted: **Wed Mar 19, 2008 12:46 pm**

garvinhicking wrote: This can only happen if serendipity_authenticate_author fails. Hm. s9y stores its cookie toknes in the serendipity_options table. Check if the layout of your options table is the one that comes with the default sql/db.sql layout? Maybe your tokens cannot be matched because this table is garbaged or differing...?

Code: Select all

mysql> show create table mh_s9y_options\G
*************************** 1. row ***************************
       Table: mh_s9y_options
Create Table: CREATE TABLE `mh_s9y_options` (
  `name` varchar(255) collate utf8_unicode_ci NOT NULL default '',
  `value` text collate utf8_unicode_ci NOT NULL,
  `okey` varchar(64) collate utf8_unicode_ci NOT NULL default '',
  KEY `options_idx` (`okey`)
) ENGINE=MyISAM DEFAULT CHARSET=utf8 COLLATE=utf8_unicode_ci
1 row in set (0.00 sec)

mysql>

The table only has nine entries on my system.

garvinhicking wrote: Truncating the DB table serendipity_options could be helpful in this case.

No, that didn't help. However, after truncating and logging in to s9y, the table still had 0 rows. Shouldn't the login process create a row there?

Greetings
Marc

Posted: **Wed Mar 19, 2008 1:31 pm**

Zugschlus wrote: No, that didn't help. However, after truncating and logging in to s9y, the table still had 0 rows. Shouldn't the login process create a row there?

And a full mysql server log shows that the table is not accessed when somebody logs in to the blog.

Greetings
Marc

Serendipity Forums

Cookie Handling Issues with Konqueror?

Konqueror, Iceweasel and Kazehakase

Re: Konqueror, Iceweasel and Kazehakase

Re: Konqueror, Iceweasel and Kazehakase

Re: Konqueror, Iceweasel and Kazehakase