Automatically logged out of admin panel. Cannot update stock.

[lipsticknvodka]

www.blackmarketartcompany.com

I am able to login to the Zencart admin panel, but if I attempt to navigate to any other page, I am kicked off and unable to add, edit, or delete stock.
The following warning appears at the top of the admin home page. Wondering if this would fix the issue.

Warning WARNING: The Admin Activity Log table has records over 2 months old and should be cleaned ... 05-12-2020

I also made some recent changes to my configure.php file to fix a separate issue in which the shopping cart would not update when customers added items to the cart. I would not think that would be the issue, but since I am new to Zencart and this company, I don't know if the issue started at the same time or before. Please help!

[lat9]

That message has nothing to do with your automatic log-out of the admin. I'll note that zc1.3.9h is woefully old and most likely requires PHP 5.4 (or earlier) which is also woefully old.

There have been a ton of security-related changes over the past 10 years in PHP, browsers and Zen Cart. I'm guessing that you're experiencing an admin-based session issue but don't have much information to work with.

You could post the upper portion of the admin's /includes/configure.php, the default looks something like

  define('HTTP_SERVER', 'http://localhost');
  define('HTTPS_SERVER', 'https://localhost');
  define('HTTP_CATALOG_SERVER', 'http://localhost');
  define('HTTPS_CATALOG_SERVER', 'https://localhost');

  // secure webserver for catalog module and/or admin areas?
  define('ENABLE_SSL_CATALOG', 'false');
  define('ENABLE_SSL_ADMIN', 'false');

which would help. Have you applied the samesite-cookie patch to the admin's /includes/init_includes/init_sessions.php?

[lipsticknvodka]

I have attached an image of the configure.php settings below. I have not modified anything in the session file. I am coming onto this team not knowing much about what has been done in terms of updating Zencart previously.

[lat9]

Not seeing that image. You can copy/paste the contents in 'CODE' tags (the big # in the menu bar above).

[lipsticknvodka]

// Define the webserver and path parameters
  // HTTP_SERVER is your Main webserver: eg-http://www.your_domain.com
  // HTTPS_SERVER is your Secure webserver: eg-https://www.your_domain.com
  define('HTTP_SERVER', 'https://blackmarketartcompany.com');
  define('HTTPS_SERVER', 'https://blackmarketartcompany.com');

  // Use secure webserver for checkout procedure?
  define('ENABLE_SSL', 'true');

[lat9]

That doesn't look like a zc139h /admin/includes/configure.php. Did you pull that from the /includes directory?

[lipsticknvodka]

I'm sorry. I did post it from the wrong configure.php file. Thank you for your patience.

   *
   * If you desire your *entire* admin to be SSL-protected, make sure you use a "https:" URL for all 4 of the following:
   */
  define('HTTP_SERVER', 'http://www.blackmarketartcompany.com');
  define('HTTPS_SERVER', 'https://www.blackmarketartcompany.com');
  define('HTTP_CATALOG_SERVER', 'http://www.blackmarketartcompany.com');
  define('HTTPS_CATALOG_SERVER', 'https://www.blackmarketartcompany.com');

  // Use secure webserver for catalog module and/or admin areas?
  define('ENABLE_SSL_CATALOG', 'true');
  define('ENABLE_SSL_ADMIN', 'true');

[dbltoe]

This will get you started

   *   * If you desire your *entire* admin to be SSL-protected, make sure you use a "https:" URL for all 4 of the following:
   */
  define('HTTP_SERVER', 'https://www.blackmarketartcompany.com');
  define('HTTPS_SERVER', 'https://www.blackmarketartcompany.com');
  define('HTTP_CATALOG_SERVER', 'https://www.blackmarketartcompany.com');
  define('HTTPS_CATALOG_SERVER', 'https://www.blackmarketartcompany.com');


  // Use secure webserver for catalog module and/or admin areas?
  define('ENABLE_SSL_CATALOG', 'true');
  define('ENABLE_SSL_ADMIN', 'true');

Add the items in red.

[dbltoe]

Since you have a 301 redirect going to the non-www secure site, I would change that to

* * If you desire your *entire* admin to be SSL-protected, make sure you use a "https:" URL for all 4 of the following:
*/
define('HTTP_SERVER', 'https://blackmarketartcompany.com');
define('HTTPS_SERVER', 'https://blackmarketartcompany.com');
define('HTTP_CATALOG_SERVER', 'https://blackmarketartcompany.com');
define('HTTPS_CATALOG_SERVER', 'https://blackmarketartcompany.com');


// Use secure webserver for catalog module and/or admin areas?
define('ENABLE_SSL_CATALOG', 'true');
define('ENABLE_SSL_ADMIN', 'true');

Note that all are set to https BUT, the www. is gone.

[lipsticknvodka]

Thank you so much for all of your help. This worked for this website, but I am having a similar issue with my site at www.lowbrowartcompany.com. I have done the same thing and added the "s" to the "http" in both configure.php files (store and admin). Any idea what could be causing this issue again?