There was a security error when trying to login

[asterix]

I have an issue with not being able to log in after creating an account ("There was a security error when trying to login"). I did a full 3.8 install and updated the necessary files to 3.8a.

When I create an account, I can successfully place an order but I cannot log back in after logging off, even using the "forget password" feature.

Where should I look?

[DrByte]

This issue is discussed in the following tutorial. It's related to customized files in your template:
http://tutorials.zen-cart.com/index.php?article=312

Related thread:
http://www.zen-cart.com/forum/showthread.php?t=84197

[asterix]

Looks like that was it. Thanks again! :)

[ScrapdragonDesigns]

Situation:

I have just upgraded and now getting this error when trying to login from the customer screen "There was a security error when trying to login"

Cause:

Zen Cart™ v1.3.8 has an added security feature to prevent spoofed external logins. A "security token" field has been added to all login forms. This token must be current (not expired), and must be submitted with login username+password in order for logins to work properly.

Remedy:

If you have customized template "login" files, the new security features need to be merged into your customized template files.

The following files are affected:
- /includes/templates/YOUR_TEMPLATE/templates/tpl_login_default.php
- /includes/templates/YOUR_TEMPLATE/templates/tpl_timeout_default.php

And if you're encountering it in your Admin area, this file is affected as well:
- /admin/login.php


Additionally, if you have customized your /includes/functions/sessions.php file for some reason, you'll also need to merge the new changes for this core file into your customized version.

I am getting this error message when trying to login to the store admin. I have tried logging in as a customer and all seems fine. I raised the issue as a support ticket with my web hosting but they have only reached the above point with me so far. Obviously, the first part of this relates to customers and I didn't customise those files anyway.

However, even though I didn't customise this file
And if you're encountering it in your Admin area, this file is affected as well:
- /admin/login.php
I am guessing this is what is causing the problem
Trouble is, I can't find the file to look at it or amend it!

Any help is appreciated and please remember when replying that I am stupid - therefore you need to explain things in simple terms, lol.

Other useful info,,, my web host has changed my password so many times I have no idea what it is anymore!
this was not a full install, but I upgraded through my web host cpanel (fantastico)

[yellow1912]

I am getting this error message when trying to login to the store admin. I have tried logging in as a customer and all seems fine

What do you mean? How can you login in as customer on store admin?

Did you try to copy admin/login.php from the download package, and upload it to your server?

[ScrapdragonDesigns]

Sorry, I wasn't very clear. I have been reading the forum and it seems a lot of people have a similar error but with regard to customer login. I have a customer account in my store and I logged into that and logged out and in again and didn't have any problems.

However, I can't get into the admin area at all. I finally located the admin/login file and have downloaded it, but I can't for the life of me see what I need to change on it. I didn't customise any of these files in the first place and I don't want to make things worse by changing anything when I don't know what I'm doing.

No, I didn't copy any file and upload, I just clicked the upgrade button in fantastico, then I reuploaded all the customised files

I just need to over-ride this security thing
TIA

[yellow1912]

If you didnt customize the admin side, you can safely download the 1.3.8a package, then upload that admin/login.php file to your server, overwrite the current one.

[DrByte]

this was not a full install, but I upgraded through my web host cpanel (fantastico)

Number one lesson ... don't do that !
Fantastico's upgrader is not reliable and should not be used.
A manual upgrade is *always* the recommended approach.

[mooncavecrystals]

ok, bear with me cause I am stupid too :) I upgraded as well and am having the log in error. So...what you are saying is to use winmerge and put the files side by side ...my customized and the newest version of the zen file. Then i take the yellow highlighted new zen files and copy and paste them to the customized file. Then reupload??

This stuff scares me to death :) thanks for taking the time to verify this for me :)

[pillaroom]

Okay Dr Byte. This is going to sound insane, but I am hoping that you can help me. When I went to test my customer login it returned the security error mentioned above. After reading the posts I figured that the issue had to lie in tpl_login. The thin that is different about my situation is that I did a clean install of 1.3.8a. Not an upgrade. But because nothing else seemed to work I compared a new 1.3.8a tpl_login file with the one on my site using WinMerge. It turns out that the login file that was at my site was copyright 2006. The new one was 2007. I copied the new files over and it all works fine.

Here's my problem. How did the old tpl_login get there? One other material fact. Up until I added Google Checkout the login worked fine.

Any thoughts? Am I just insane?
Brad