Admin Login Looping after 1.3.7 to 1.3.7.1 upgrade

[PanzerBoxb]

After using Fantastico to upgrade from 1.3.7 to 1.3.7.1 I am encountering admin login loops. I have ensured that both the /includes/configure.php and /admin/includes/configure.php were set with the proper URLs for both HTTP and HTTPS. The enable SSL variables have been set as well.

define('ENABLE_SSL_CATALOG', 'true');
define('ENABLE_SSL_ADMIN', 'true');

Now, whenever I enter the proper username and password, it simply reloads the login page. Even disabling SSL does not work. Thoughts?

[DrByte]

If you set those SSL settings to 'false' temporarily, is there any change ?

[CJPinder]

Hi,

If it was working on v1.3.7 but stopped working after moving to v1.3.7.1 then it sounds like a problem with session regeneration. There was a fix to the admin/login.php file in v1.3.7.1 to stop a potential security exploit known as 'session fixation'. To be honest I doubt anyone could actually use the exploit in this case except under strict lab conditions. If you get really stuck then just upload the admin/login.php file from the v1.3.7 distribution (or your backup). That should let you get back in.

DrByte, any ideas on the session regeneration problems? Everytime I think I've tracked down what's causing it, it seems to be something else.

Regards,
Christian.

[PanzerBoxb]

If you set those SSL settings to 'false' temporarily, is there any change ?

DrByte, my apologies, I was not very clear. I did disable SSL by setting both those to false. No change in the behavior. My last resort is to restore the 1.3.7 store so I can regain functionality.

[CJPinder]

My last resort is to restore the 1.3.7 store so I can regain functionality.

Before putting everything back try just uploading the 1.3.7 version of the admin/login.php file.

Regards,
Christian.

P.S.
Just an after thought but you haven't by any chance changed any of your .htaccess files have you?

[PanzerBoxb]

If this fails it makes me worry that something else is broken, hence my preference to return to 1.3.7. None of the .htaccess files were modified.

[CJPinder]

If this fails it makes me worry that something else is broken, hence my preference to return to 1.3.7.

I appreciate your concern. It is entirely possible that a file did not upload correctly during the upgrade or some other error occurred. The only way to know for sure is to either upload all the v1.3.7.1 files again or restore back to v1.3.7 and do another upgrade.

It would be very useful to know though whether or not putting back the v1.3.7 version of admin/login.php cures your problem.

Regards,
Christian.

[tinypack]

I experienced the login loop problem when I tried to install my store on a local host. Replacing the login file from the 1.3.7 set seemed to fix the problem. If there is a better solution, I would like to know what it is.

[wilt]

when you are getting the login loop are there any error messages.
e.g. 'There was a security error when trying to login.'

Also you could also try disabling the session_recreate at line 46 of admin/login.php just comment out the line

zen_session_recreate();


and see if that helps.

[PanzerBoxb]

OK, this is weird. I commented out the line (was line 42, not 46) and was able to log in once again. However, as a test, I went in an enabled it again and I can still log in to the admin interface.