Who's Online showing multiple entries for my own IP

I dont have a download problem. I have a problem with the 'whos online' count as per this thread. I only wondered if this problem was caused by moving the download folder

Then the answer would be "No, I see no reason why that would cause the problem".

Vger

The ISP I am using at home is Frontier. A friend of mine who was able to duplicate the problem was connected through a military ISP. I am at work today and we are using Comcast and I was also able to duplicate the problem as well. And just to really test it, I had my friend log in as he is a registered user. And even when he was already logged in, each time he refreshed the site, the member number goes up… So I am ruling out the possibility of the ISP causing this….

Okay, as this isn't a general problem (only a very few people are having this problem), and as it does not seem to be ISP related (AOL), then that leaves Server Related.

There was a known problem with 1.3.8+ and Who's Online if SuHosin (also called Hardened PHP) was installed on the server on top of SuExec. Some hosts installed this as an extra security measure, but SuHosin encrypts session data and this caused problems with Who's Online. In 1.3.8+ the problem it caused was in slowing down the loading of Who's Online or preventing it from loading at all. In 1.3.9+ the problem may be manifesting as multiple sessions being created for the same visitor.

What SuHosin does is to take the Zen session id and encrypts it. Unfortunately this means that Zen does not recognise the encrypted session as being the session it created, and so the next click results in a new session being created, which is also encrypted by Suhosin - and so it goes on.

Go to Tools --> Server Info and it should tell you there if SuHosin is installed.

If Suhosin is installed then you need to get your hosting company to modify SuHosin slightly so that the session_encrypt function is turned off.

Vger

Does turning off the session_encrypt function will most likely exposed my site to a possible security breach? Would it be better to leave the annoyance of incorrect who's online functionality than turning off the session encryption?

Session encryption is only one of the functions performed by SuHosin, and SuHosin only enhances the security that is already provided by SuExec or SuPHP, so the answer is that it would have a marginal impact on security but a big impact in allowing your site to function correctly.

It's worth pointing out that session encryption is not a problem for Zen Cart alone. In the default root level .htaccess file that comes with Magento this line is included:

php_flag suhosin.session.cryptua off

...but depending upon what functions you can manage via .htaccess, which will vary with each hosting company, you may not be able to turn off session encryption in that way. It may have to be done at server level by your hosting company.

Does your server have SuHosin installed?

Vger

I checked and it showed:

This server is protected with the Suhosin Patch 0.9.7..

Although I notice that the logs are set to OFF on Local and Master Value and most of it says no value.

Pardon me but this is foreign to me. I don't really know what these means.

What it means is that SuHosin is installed on your server and this is the reason you have problems with new sessions being created every time someone clicks on a new link or refreshes a page.

I advise you to run a 'live' test order through your site:

a. To see if it is possible to complete an order, and
b. To see if your shopping cart empties when the order is completed.

I suspect that the shopping cart will not empty, which would be something of a disaster.

Vger

I've checked mine which I remember doing before via this thread and all values for SuHosin are either 0, off or no value. I am using Bluehost as my hosting server as are 5 other stores that I am aware of and they dont have this problem. I have also had friends from Canada, South Africa, UK and the States check my store and they report that the whos online count increases when they refresh the page. Of course this would enable me to make my store look really busy so thats a PLUS...;o)

all values for SuHosin are either 0, off or no value

Which actually means that SuHosin IS installed. Because otherwise there would be no record for it at all. It simply would not show up.

Vger

I havent had any problems with sales or the cart emptying. All downloads have been working fine.
A question though....as I use Bluehost (recommended by Zen) as do a lot of other stores that I know about - surely they would have the same problem that I am having with the count?
So, if it is the SuHosing thingy...what now?

I am trying to get to purchase right now and found these errors:

1. When I use my PO BOX as the shipping address it shows “Unable to process payment. Please contact the merchant as the shipping address provided by the merchant is invalid, and the merchant has requested that your order must be shipped to that address.” I am going through PayPal.

2. It’s charging me a $3.00 shipping fee when I specifically put 0.00 on the weight. I am using this functionality as I am not using a flat rate fee and different products costs different shipping fee…

Any input is much appreciated.

Those don't sound like they have any relation to the SuHosin problem. They sound more like effects of admin shipping module settings.

The problems you may experience with SuHosin will vary according to which version of Zen Cart is in use, and which SuHosin functions have been enabled.

It's not a Zen Cart bug - it's a SuHosin problem.

First thing to do is to raise a Support Ticket with BlueHost/Host Monster (same company) and get confirmation that SuHosin is installed and that SuHosin is encrypting sessions.

Also check to see which version of PHP is being used on your server (Tools --> Server Info), because from PHP 5.3 and especially from PHP 5.3.3 the way that the server handles sessions has been changed by default. Zen Cart will try to switch from sessions visible in the address bar to sessions stored in a cookie on the visitors PC within one or two clicks of them joining the site, but won't force the issue if the users browser does not accept the cookie.

There is a setting in a servers php.ini file, which is commented out prior to 5.3, which specifies that all sessions must be stored in cookies, which is similar to the Zen Cart setting "Force Cookie Use". From 5.3 onwards it is recommended that this line is uncommented, and with PHP 5.3.3 that line is uncommented by default - so the server tries to force session storage in cookies. That session is also a server generated session and not a Zen Cart session.

Vger

This is the php.ini setting I refer to, which is commented out in this sample:

; This option enables administrators to make their users invulnerable to
; attacks which involve passing session ids in URLs; defaults to 0.
; session.use_only_cookies = 1

Vger

I was able to fixed the shipping issue and I was able to make a purchase and the shopping cart got empty. So it seems that only the Who’s Online functionality is the wacky part right now…

Well, that's down to SuHosin encryting sessions - so that's up to your hosting company to disable.

Vger

This is still weird to me because it was working just fine when I first installed it and up until a few days ago when I started deleting some banners and images...

I will contact my hosting company. If this has happened before, I am sure they are aware of it since I got Zen Cart through them...

Thank you for your responses!

You can try adding either of these to a root level .htaccess file, to see if either works:

php_flag suhosin.session.encrypt = Off

or

php_value suhosin.session.encrypt = Off

If neither of these works, or if they cause a "500 Internal Server" error, then remove that code. It will mean that the server configuration does not allow you to disable session encryption yourself, only via your hosting company.

Vger

Hello All,

I'm sorry to bump an old thread, but I too have had this problem. I did a search and found this post so I thought I would share what I just experienced.

Recently I installed the latest version of Zen Cart. I'm learning as I go along, but things had been going nicely thus far. However, today I am experiencing issues like the OP with the "Who's Online" count bumping up from the same IP.

I read through all the comments and checked everything from the SuHosin to attempting to make a purchase. I am able to make a purchase with the shopping cart emptying post-purchase. Yes, my host uses SuHosin.

I've gone through and tried using Firefox, IE, and Chrome. It ends with the same result of bumping up the visitor count each time I: refresh, click on a link that brings me back to the same site, and keying the website address in.

Last night I had set my site to "down for maintenance" until a few hours ago. Ever since then I had the problem with "Who's Online". Of course after I went through each of the trouble shooting suggestions, I decided to put it back down for maintenance and bring it back up to be live again.

For the time being, it's working as it should. I just thought I would update this post, in case any of you had the same issue after taking the site down for maintenance.

Thank you to the previous comments as they have helped me be a bit more knowledgeable in case the "SuHosin" interferes. :)