Whoops! Your session has expired. after paypal continue, since webserver upgraded

[Justwade]

Hello,
I searched and searched the forum, but need to ask what I might try next.

I have a zen store 1.3.7 running successfully for several years almost without need for coding. I believe I did all the updates that would make it 1.3.7.1 as they were announced. But do to burn out with other life issues, I have been waiting for a version above 1.3.8a before upgrading.

Ok, this is what happened;
Last week my host (no its not Go Daddy) upgraded server to Apache 2.2.11 and PHP 5.2.9. (I have already contacted them and they are looking into below problem, they have always served me well)

A customer and my own tests show the store checkout or Paypal Express button goes to PayPal as it should. You enter password and PayPal's first page comes up, then if you push "continue" button, PayPal redirects back to store to the "Whoops your session has timed out" and a place to login. No record or completion of sale is doable.

This is a relearning process for me, so please forgive my absence. I tried Dr. Bytes curl test and the ipncheck139.zip and results all appears ok.

Is there an issue with Zen 1.3.7 and these recent server upgrades?
Or should I be looking elsewhere?
I did go to PayPal and they are missing around with things too, but it appears they should be done by now.
Any ideas or overlooked threads I could look at?
Thank you,

JW

[kobra]

upgraded server to Apache 2.2.11 and PHP 5.2.9. (I have already contacted them and they are looking into below problem,

Have them check their php settings around time they might be using php's defaults

[Justwade]

Thanks for the tip Kobra, I passed it on to my host. They thought the problem was resolved and asked me to test again. They didn't tell me what they did, but it failed to work. They are looking into it again.

I am now searching for my API Signature Password with no luck. I can't remember where it is, and my old notes are unforgiving. I was thinking of removing PayPal in admin and then reinstall with my same settings, but I need to get pass that dang password roadblock for that trial.

I will follow up if anything works.
Thanks,
JW

[Justwade]

Just a note;
I found my password in PayPal - Profiles on left in API Access for those who may be of need.
Anyway the remove and reinstall of PayPal did not work.
Host has bumped me up to "Level 2 Support"

JW

[Justwade]

I got a response from my host at TCH. Below is also their answer to my store situation. The link PHP info is beyond me.
JW

PHP configuration can be viewed at -- http://skywalker.tchmachines.com/phpInfo.php

I would appreciate if you can give the cart developers this link and let me know their update regarding the php configuration. No major changes were made to the php setup except the version upgrade along with apache upgrade.

[kobra]

That info is not where they need to be concentrating and it is not really the purpose of this venue to instruct them on how to configure their servers....
This is quoted from the doc's and pertinent to the .cnf files that they should know about

# Manual edits of this file will be lost when Apache is updated.

So if they had any timings for php or mysql adjusted(optimized) for faster php/mysql operation they are gone
Contact me via my profile details

[Justwade]

Well, I am just now able to follow up, a long holiday spending my new years eve day and days after removing hacks and rebuilding the site.

After a troubling year and then an obvious hacked site exactly 30 days after this Session Expire issue in June of 09 I just had to shut this store down, too many other stressed out priorities for other lives and for some who are not with us anymore.

I totally volunteered to learn these codes, and Zen's ways, find the community very supportive and make no money from it. But the one who I made the store for certainly could of used the funds they missed out on. Ha, ha, little hacky pranksters just not really hurting anybody, so it appears, in their little denial minds.

Now to the issue still apparently at hand;
It appears a similar thread on this subject is at- http://www.zen-cart.com/forum/showthread.php?t=136371.

My search so far has not found an answer. For me, "All browsers" PC or Mac had the time out issue, and I have yet to tried the suggestions in this thread.

After rebuilding from the hack, reinstalling PayPal, reinstalling USPS, and doing "all" the suggested patches, my store finally "appears" to work, but not the PayPal Express for the same reason as before -"Whoops! your session has expired.

I noticed a suspicious order when PayPal Express started this symptom, finally turned it off and used just PP IPN, then got the hack attack in July like many others. Also my custom Logo on PayPal was not linked anymore. I wonder if their was a connection to the hack or just another coincidence, such as my server also upgrading the PHP near that date in June. I just wonder and wonder.

[Justwade]

Below is the follow up posts my server provided since our correspondence Kobra, I apologize for the delay. If they are of any help in pointing me a different direction. I tried every setting I could on PayPal Express, it now is turned off.

Posted On: 07 Jun 2009 07:27 PM
I have been rechecking and reinstalling some of my code for zen store and keeping on top of this all weekend. But all tests are the same as prior ticket. Same time out issue warning when directed from PayPal to my store. Store has been running for over 2 years with no problems and had no problems with your prior upgrade(s) of the server. But this last upgrade situation has made store not able to make sales.

Below is Kobra's at Zen Forum answer to your provided link to server
settings.

> kobra
>
> Join Date: Aug 2005
> Posts: 15,366
> That info is not where they need to be concentrating and it is not really the purpose of this venue to instruct them on how to configure their servers....
> This is quoted from the doc's and pertinent to the .cnf files that they should know about

> Quote:
> # Manual edits of this file will be lost when Apache is updated.
> So if they had any timings for php or mysql adjusted(optimized) for faster php/mysql operation they are gone.


their reply;

Posted On: 07 Jun 2009 09:11 PM
Hello,

None of the Apache settings have changed on the recompile, as we keep a tab on such tweaks. But this does not include any custom changes that you may have done on the scripts or via overrides on .htaccess.
I am checking for possible leads but would really appreciate if the developer can pin point exactly what could potentially cause such an issue, as he will be able to debug the script faster.

Regards,
C--- N----
Level 2 System Administrator


My reply:

Posted On: 08 Jun 2009 02:22 PM

I am still gathering info, and making tests with logs.
Could you tell me, do you have other Zencarts on this server?
Are they ok?

Their reply:

Posted On: 08 Jun 2009 02:37 PM
Hi,

There are another 4 active installations of Zen Cart on your server itself and many of our users having Zen cart on many of our other servers. However, the issue that you have stated is not raised by any others. That is why still we are saying that it is not something related to the server software upgrade. As C--- suggested, kindly get back to us with the inputs from the developer side - so that we can fix it for you.

Thank you.
Regards,
A---- S----

Thanks,

[kobra]

If they are of any help in pointing me a different direction.

I have a zen store 1.3.7 running successfully for several years almost without need for coding.

Last week my host upgraded server to Apache 2.2.11 and PHP 5.2.9.

Think that this covers it if you are certian that you have not changed/added anything around this time

[Justwade]

I am certain I did not change anything, but I did get what appeared to be a large bogus purchase about the same time as the host upgrade that did not complete, PayPal Express broke ever since. I turned PPEx. off soon after reinstalling and trouble shooting, then 30 days later I get "tagged" as Hacked in image files. I may have been hacked all along, but didn't know it tell they announced it to me. I reinstalled PayPal again right away, did some patches, but that didn't work, with other priorities needed, I shut down completely.

It could be the Host, maybe they changed something but claim they didn't. I am now finished doing the "Recovering from Hacks", I did "all" the security patches, I gave the transaction more time to lock in at Admin setting (yet it is only seconds to get the timeout). My store has been down since early July 09. The timing of the bogus purchase, not knowing we were hacked tell later, and the Host changes just complicates it all. At least the IPN Paypal works ok.

I will try the Host again, I read somewhere on this forum about a new PHP security thing some Hosts were adding that gave the 1.38 people similar problems, but haven't re-found the thread to get its name. I'll look some more and try that route.
Thanks for your reply,