Printable View
I've been through all my files and removed all URL's that point to non-secure files which has at least got rid of the "security error when trying to log in" message, but my customers STILL can't log in - all they get on submitting their email address and password is a refresh of the logging in page! Anyone know whats happening here?
What if you turn off this ...
Code:<object classid="clsid:d27cdb6e-ae6d-11cf-96b8-444553540000" codebase="http://download.macromedia.com/pub/shockwave/cabs/flash/swflash.cab#version=7,0,0,0" width="570" height="100" id="images/scroll3" align="middle">
<param name="allowScriptAccess" value="sameDomain" />
<param name="movie" value="images/scroll3.swf" />
<param name="quality" value="high" />
<param name="bgcolor" value="#ffffff" />
<embed src="images/scroll3.swf" quality="high" bgcolor="#ffffff" width="570" height="100" name="images/scroll3" align="middle" allowScriptAccess="sameDomain" type="application/x-shockwave-flash" pluginspage="http://www.macromedia.com/go/getflashplayer" />
</object>
You might also want to look at these issues in the FAQs on the security token ...
https://www.zen-cart.com/tutorials/index.php
and do a search on: "security error when trying to log in"
No, theres some sort of 'loop' running. Regardless of whether that item is in the header or not, filling in correct details in the 'Returning Customers' fields just takes me back to shopping cart contents. So I click Go To Checkout and I get back to the page for entering 'Returning Customers' or create a new account :blink:
I've done the 'token' edits already
And ... if you go to Admin->Tools->Server Information, what version information appears?
And list all the addons you've installed on your site.
ie: in what ways is your site different from a clean uncustomized install?
Server Information
Server Host: server.dnsblock2.com (85.13.232.210) Database Host: localhost (127.0.0.1)
Server OS: Linux 2.6.18-92.el5PAE Database: MySQL 5.0.51a-community
Server Date: 12/24/2008 16:30:16 Database Date: 12/24/2008 16:30:16
Server Up Time: 16:30:16 up 133 days, 20:28, 1 user, load average: 0.03, 0.03, 0.00 HTTP Server: Apache/2.0.63 (Unix) mod_ssl/2.0.63 OpenSSL/0.9.8b mod_auth_passthrough/2.1 mod_bwlimited/1.4 FrontPage/5.0.2.2635
PHP Version: 5.2.6 (Zend: 2.2.0) PHP Memory Limit: 32M PHP Safe Mode: Off
PHP File Uploads: On Max Size: 2M POST Max Size: 8M
Database Data Size: 862 kB Database Index Size: 582 kB
I've added the mySQL and Site Backup mods, blank sidebox, additional images relocated with CSS, and the Column Layout mod. And a partridge in a pear tree :cool:
And what version of Zen Cart is it reporting on that screen?
Zen Cart 1.3.8aQuote:
Originally Posted by DrByte
Database Patch Level: 1.3.8
v1.3.8 [2008-11-04 17:14:01] (Fresh Installation)
v1.3.8 [2008-11-04 17:14:01] (Fresh Installation)
What is the content of your /includes/configure.php file, without the database password.
Code:<?php
/**
* @package Configuration Settings circa 1.3.8
* @copyright Copyright 2003-2007 Zen Cart Development Team
* @copyright Portions Copyright 2003 osCommerce
* @license http://www.zen-cart.com/license/2_0.txt GNU Public License V2.0
*/
/*************** NOTE: This file is similar, but DIFFERENT from the "admin" version of configure.php. ***********/
/*************** The 2 files should be kept separate and not used to overwrite each other. ***********/
// Define the webserver and path parameters
// HTTP_SERVER is your Main webserver: eg, http://www.yourdomain.com
// HTTPS_SERVER is your Secure webserver: eg, https://www.yourdomain.com
define('HTTP_SERVER', 'http://www.shedtraders.co.uk');
define('HTTPS_SERVER', 'https://www.shedtraders.co.uk');
// Use secure webserver for checkout procedure?
define('ENABLE_SSL', 'true');
// NOTE: be sure to leave the trailing '/' at the end of these lines if you make changes!
// * DIR_WS_* = Webserver directories (virtual/URL)
// these paths are relative to top of your webspace ... (ie: under the public_html or httpdocs folder)
define('DIR_WS_CATALOG', '/');
define('DIR_WS_HTTPS_CATALOG', '/');
define('DIR_WS_IMAGES', 'images/');
define('DIR_WS_INCLUDES', 'includes/');
define('DIR_WS_FUNCTIONS', DIR_WS_INCLUDES . 'functions/');
define('DIR_WS_CLASSES', DIR_WS_INCLUDES . 'classes/');
define('DIR_WS_MODULES', DIR_WS_INCLUDES . 'modules/');
define('DIR_WS_LANGUAGES', DIR_WS_INCLUDES . 'languages/');
define('DIR_WS_DOWNLOAD_PUBLIC', DIR_WS_CATALOG . 'pub/');
define('DIR_WS_TEMPLATES', DIR_WS_INCLUDES . 'templates/');
define('DIR_WS_PHPBB', '/');
// * DIR_FS_* = Filesystem directories (local/physical)
//the following path is a COMPLETE path to your Zen Cart files. eg: /var/www/vhost/accountname/public_html/store/
define('DIR_FS_CATALOG', '/home/shedtrad/public_html/');
define('DIR_FS_DOWNLOAD', DIR_FS_CATALOG . 'download/');
define('DIR_FS_DOWNLOAD_PUBLIC', DIR_FS_CATALOG . 'pub/');
define('DIR_WS_UPLOADS', DIR_WS_IMAGES . 'uploads/');
define('DIR_FS_UPLOADS', DIR_FS_CATALOG . DIR_WS_UPLOADS);
define('DIR_FS_EMAIL_TEMPLATES', DIR_FS_CATALOG . 'email/');
// define our database connection
define('DB_TYPE', 'mysql');
define('DB_PREFIX', '');
define('DB_SERVER', 'localhost');
define('DB_SERVER_USERNAME', '***');
define('DB_SERVER_PASSWORD', '***');
define('DB_DATABASE', '***');
define('USE_PCONNECT', 'false'); // use persistent connections?
define('STORE_SESSIONS', 'db'); // use 'db' for best support, or '' for file-based storage
// The next 2 "defines" are for SQL cache support.
// For SQL_CACHE_METHOD, you can select from: none, database, or file
// If you choose "file", then you need to set the DIR_FS_SQL_CACHE to a directory where your apache
// or webserver user has write privileges (chmod 666 or 777). We recommend using the "cache" folder inside the Zen Cart folder
// ie: /path/to/your/webspace/public_html/zen/cache -- leave no trailing slash
define('SQL_CACHE_METHOD', 'database');
define('DIR_FS_SQL_CACHE', '/home/shedtrad/public_html/cache');
// EOF
Can you login to your admin area okay?
Does this help?
Go to your Admin area, to Tools->Install SQL Patch, paste the following command, and click Send:That's gonna knock all existing shoppers off. But does it then allow them to login properly afterward?Code:truncate table db_cache;
truncate table sessions;
Admin area is fine. I ran the queries you suggested, but still the loop runs - enter email and password, click Login, and it goes back to 'Your Shopping Cart contents'. :blush:Quote:
Originally Posted by DrByte
Some element of progress, or perhaps not :dontgetit
Just to check, I reverted back to the default template to see if that made a difference - it didn't. Then I tried accessing it in IE7 (I normally only use FF) and got the flag 'This page contains both secure and non-secure items. If I ignored that, I finally got to Step 1 of 3 - Delivery Information. So I went back and took out the flash file recommended earlier in the thread and tried again in IE - same result. So there is another insecure element of the page, maybe another directly referenced image that I cant see, thats causing IE to flag up the warning (FF doesn't show an 'error', just the padlock icon shows a little red exclamation mark).
If I ignore that though, it seems IE can log in and FF cant? Could that be linked to the 'insecure' element?
Found and removed the insecure item - it was a direct reference to a http file rather than a https one in html_header.php. So now it seems at least that I can log in properly with IE, but cant with FF? Just to be doubly sure, I'd like to 'log out' of my account in both browsers, but I dont have a log out link - where's that been lost from? I know I can delete the cookies, but I cant easily differentiate between admin cookies and customer ones in my browser list!
If you're missing a logoff link, then you've definitely got problems with your template files.Quote:
Originally Posted by travellers
You can force a logoff by going to YOURSITE.COM/index.php?main_page=logoff
'S'okay, found that - I'd just disabled the header bar while playing around laying out my template is all. Thats turned back on now!Quote:
Originally Posted by DrByte
I have had the second email about customers not being able to log back in even after getting a new password.
On both Mac and Windows PC's, I can create a new account and replay the complaint. I can get in fine.:frusty:
Maybe a cluster issue on the server?
Other than the password is anything case sensitive?
Would the Easy Sign Up and Login clear up any issues?
Anything I can do to make login any simpler?
Ummm, I've no idea what that post means :blush:. Are you in the right thread?
Clearly not in the right thread.
Are we at the end of the possibilities now? I'm dreading the thought of doing it, but I'll have to pretty much reinstall if the problem cant be tracked down. If that really is the stage I'm at, can anyone suggest a list of files to start overwriting that will definitely cure the problem without having to rewrite all the changes to standard I've made?
Replace the two files
- /includes/templates/YOUR_TEMPLATE/templates/tpl_login_default.php
- /includes/templates/YOUR_TEMPLATE/templates/tpl_timeout_default.php
and
- /includes/templates/template_default/templates/tpl_login_default.php
- /includes/templates/template_default/templates/tpl_timeout_default.php
Or try backing the files up from your custom template folder then deleting them see if this helps. Keep the files
- /includes/templates/template_default/templates/tpl_login_default.php
- /includes/templates/template_default/templates/tpl_timeout_default.php
in place do not delete both places at the same time but can replace at same time.
It seems you still have old code from a previous version of zencart. Download a brand new copy of zencart and replace the files in the custom folder and template_default folder.
Be sure to back them up where you can merge any modifications over to the newer files.
Also your site still kicks the non secure items in IE so do the following and that should fix that issue as well.
<object classid="clsid:d27cdb6e-ae6d-11cf-96b8-444553540000" codebase="https://download.macromedia.com/pub/shockwave/cabs/flash/swflash.cab#version=7,0,0,0" width="570" height="100" id="images/scroll3" align="middle">
<param name="allowScriptAccess" value="sameDomain" />
<param name="movie" value="images/scroll4.swf" />
<param name="quality" value="high" />
<param name="bgcolor" value="#ffffff" />
<embed src="images/scroll4.swf" quality="high" bgcolor="#ffffff" width="570" height="100" name="images/scroll4" align="middle" allowScriptAccess="sameDomain" type="application/x-shockwave-flash" pluginspage="https://www.macromedia.com/go/getflashplayer" />
</object>
Change whats in red to your code
If you choose to install a new cart, why not try installing a second site on your server ... ie: a new folder and new database, with demo data ... and check whether the problem still exists in a clean install. If yes, then your server's likely to blame. If not, then one or more of your addons is likely to blame. Adding things back one by one could reveal whatever's broken it.
Or ... http://www.zen-cart.com/wiki/index.p...Obscure_Issues
I do not have any trouble logging into an old account on your site nor do I have any trouble creating a new account on your site ... :smile:
Have you resolved this problem?
Sorry for slow replies - had to be out all day yesterday and am about to go out all day today too, but will try some of these tonight.
Host99, thanks for spotting the Macromedia URL's - it hadn't occurred to me I could append 'secure' to them too. I'll try renaming the two files you mention and see if it makes a difference.
DrByte, I'm pretty certain that this is a 'new' problem and has arisen quite recently, and that I could log in with either browser just a couple of weeks ago, so a new install shouldn't have this problem. Its something I've edited since then, but I've edited a lot. So, a test install isn't really going to help me, unless I'm seeing it wrong? :blush:
Linda, hang on, are you saying that you can log BACK into an account, rather than simply create a new one? If so, which browser have you tried that in (and could you try it in the other main one too please?). Its not local to my machine because its occurred to me on more than one computer in the house, but I guess its possible its a local issue to my IP!
Update time :blush:
Again, apologies for delay in following through with suggestions - I've had a relative admitted to hospital a couple of hundred miles away and have been up and down the motorway non-stop. On to better news...
Following knuckle's advice, I renamedas temp files first, and attempted to log in. And guess what? It worked! I tried IE first and got the insecure item warning, so amended the macromedia links in the movie script and tried again - no problem logging in at all. Daring to hope, I tried FF, and was logged straight in again! Thats it, its solved! Unfortunately, as is the way with these things, its flagged up another issue but I'll have run a search on that in the forums before posting another thread if necessary - sigh :no:Code:- /includes/templates/YOUR_TEMPLATE/templates/tpl_login_default.php
- /includes/templates/YOUR_TEMPLATE/templates/tpl_timeout_default.php
But this issue is indeed resolved and my heartfelt thanks to all contributors for their advice in rectifying it. P.S. Linda - the link in your sig to http://www.zen-cart.com/index.php?ma...es&pages_id=14 isn't working correctly somewhere - on clicking the 'one time donate' I get the following message from PayPalQuote:
If you were in the process of buying something, or sending money to family or friends, we recommend you check both your PayPal account and your email inbox for a transaction confirmation after 30 minutes.
If you came to this page from another website, you may want to return to that site (we advise that you don't just use your browser's back button) and restart your activity.
The file-rename suggestions from knuckle are part of the guidance in the FAQ mentioned earlier: https://www.zen-cart.com/tutorials/i...hp?article=312 which indicates that you've got a problem with your template files ... ie: it suggests they're not designed for features in the current version of Zen Cart.
Nevertheless, glad you got it sorted out.
PayPal seems to have been having some intermittent quirky problems. Looks like the link is working again now.Quote:
Originally Posted by travellers
Well yes, but I'd done that bit (i.e. adding the tokens). The article didn't mention removing them if there were further problems. Incidentally, there's no mystery about current versions of template files, etc - both those files came to be installed as part of the Google Payments addition, and it was then I started getting security errors. I did make a post in the Google Payments support thread suggesting that it might help if they had the latest files in their download, but was met with universal silence... :blink:Quote:
Originally Posted by DrByte
Hmmm ... entirely unsurprising.Quote:
Originally Posted by travellers
However, inside this discussion, this is the first I recall you mentioning anything about Google Checkout. If you did, then I missed it. And, as with many things about that addon, I'm not surprised that things broke. But if you want to discuss that mod, the discussion belongs over in that other thread, not here.
Damn, you're right and I hadn't mentioned it before. I misunderstood the 'status' of that mod, inasmuch as I possibly gave it more credit than it deserved by assuming that as a mod designed for something as large as Google and submitted by Google themselves, it was in a position somehow 'superior' to mods submitted by Joe Bloggs like you and me. Well, me anyway...