login.php goes no where

[lj20272]

Hi,

Quick background story.... My website was recently hacked with a whole heap of files changed. I found the best way to fix this was to reinstall all of it. I have successfully installed the software and existing database as per the before installation of 1.3.9h.

Everything seemed ok until I went to test the sign in and the login page just goes nowhere.

If i try to login with an existing user account, I get a notice that says password username incorrect. If I send a forgotten password request and try the new password, the page just basically refreshes.

If I try to sign up as a new account, the page just refreshes again but the strange thing is, I get a welcome email to both the sign up address and the admin address. The account is also created and visable in the admin.

So no matter which way I try, I can't get past the login page.

www.pregnancyshop.com.au

Please help :)

Thanks in advance.

Amanda

[lj20272]

ok.. I just managed to find another thread for a similar issue which suggested to change configuration/sessions/recreate session to false.

Changing this appears to have worked but I would like to know if it is likely to create any other undesirable issues.

Thanks

Amanda

[RodG]

ok.. I just managed to find another thread for a similar issue which suggested to change configuration/sessions/recreate session to false.

Changing this appears to have worked but I would like to know if it is likely to create any other undesirable issues.

Thanks

Amanda

I recall having to do that myself at some time in the past.

I also recall DrByte stating that this was a bad thing to do (should never be done) because it opens up a security hole.

I don't think I ever did figure out the cause of the problem, and the store I needed to do it for has since closed shop.

Cheers
Rod

[lj20272]

Thanks Rod,

That's basically what the thread that I read lead into. I don't recall having to change this setting with the original setup so I wonder what is different.

One thought is that I haven't got the SSL setup yet as there seems to be a problem on the hosts side.

Does anyone know if it is likely to be something in the configure file?

[DrByte]

You could try changing either of these two settings in Admin->Configuration->Sessions. DO NOT CHANGE ANYTHING ELSE IN THERE!!!!!!!
- Use root path for cookie path
- Add period prefix to cookie domain

ALL THE OTHER SETTINGS SHOULD BE LEFT AS DEFAULTS!!

[lj20272]

Thanks DrByte.

I changed the recreate sessions back to true.

Then as you suggested, I tried changing each of the settings and ended up only requiring:

- Add period prefix to cookie domain - changed to false.

I guess this is not likely to cause any further problems???

Cheers

Amanda

[DrByte]

Test it in all the browsers you can find. Some browsers do things oddly.