Security Error- Customers can't log back in! -- IntegratedCOWOA addon

Not sure if this has anything to do with the IntegratedCOWOA(1.3.8) Add-On that I installed on my zen cart too. I read and followed the instructions on the readme file for the security_patch_v138. I changed the admin folder successfully and I can get into Admin Panel, but it still suggests the security update. Version info still says v1.3.7

Please help! I have a customer who can't log back in because of the security error.

Thank you!!!

Applying security patches has nothing to do with customers not being able to login successfully - unless patch files were inserted into the wrong place.

Vger

customers aren't able to login before and after the patch update. i thought this was the solution for the security error that they're getting.

The patch is to address security vulnerabilities in the admin code, and as Vger pointed out should have no affect on toy store/catalog.

Looking at your site, the reason you are always getting a Security Error when someone tries to login, is that the Security Token session value is never being set.

Hence in the source for the login page I see,

Note, there is no 'value' associated with this.

I have to assume that this has been caused by the COWOA contribution, or some other changes you have made to core code.

I would first look at the contribution thread for COWOA to see if any details are posted there.

I would specifically review any changes made to the login page code, the includes/functions/sessions.php code, and the includes/functions/html_output.php code.

Ok so I found it in the source, this line was manually added as per the instructions in the readme.html file that came with the security patch. What's the value that I need to enter?

"
Open the file in an editor and find the function "zen_draw_form"

The last line of this function is

return $form;
Just before that line add another line as below

$form .= '<input type="hidden" name="securityToken" value="' . $_SESSION['securityToken'] . '" />';
You can then save the file.
"

That line should only be added to
admin/includes/functions/html_output.php

If this is what you have done, then that is not the source of the error.

However it should not be added to the catalog
includes/functions/html_ouput.php

I only altered the admin section, not the includes/functions/html_ouput.php

What could be the security error then?

Your help is very much appreciated!

Hi,

The first place you need to check is your

includes/functions/sessions.php file.

Can you confirm that at around line 109 you have

    if (!isset($_SESSION['securityToken'])) {
      $_SESSION['securityToken'] = md5(uniqid(rand(), true));
    }

No I don't have that php code in sessions.php file, I did a search for it. Should I add it?

I think something went wrong when I renamed the admin folders. I also changed the configure.php file. Was there something else that I'm missing?