I don't know if this is a security problem or not so forgive me if this doesn't belong here.

I can not log in into admin using firefox (19.0) After entering username and password it just loops to log in doesn't say anything about bad username or password. I have used firefox with no log in problems for years. I have no problem using explorer or chrome.

That's not necessarily an issue about site security. It's most likely just damaged cookies in your browser. Clear your cookies and cache, and restart the browser before attempting login again.

Thanks DrByte. Glad it's not a security issue. I have cleared cache and cookies tried restarting computer still can't log in using firefox.

What's changed on your site recently?

the only thing I can think of is that I turned off better together promotion. I will turn it back on and see if that fixes it. Thanks

Is this only a problem in Firefox? Does another browser work fine? Safari? Chrome? IE?
If you access it from another computer, does it work okay there?

turning on better together didn't help. Yes, seems to only be a firefox problem. I can log in using Chrome and explorer. I haven't tried from another computer.

I'm using the latest Firefox (19.0 as of today) and have no problems with any of the latest versions of Zen Cart.

If your problem is isolated just to Firefox, then I'm inclined to believe that there's nothing wrong with your Zen Cart.
Perhaps you recently added a toolbar or other extension into your Firefox, and that's causing a problem?

I have disabled every firefox add on and extension, still can't log in. tried rebooting- nothing. I have directory password protected no problem with accepting the username and password, then I get to admin log in page and enter username and password dial spins and the boxes just become blank?

sham:

I get to admin log in page and enter username and password dial spins and the boxes just become blank?
Those are symptoms of problems with issues with invalid session/cookie handshaking.

But, since it's isolated to just one browser, it's very unlikely that there's anything to do about it on the Zen Cart end. Instead it strongly leans towards problems on your PC.

Thanks Dr Byte. I'll keep checking things on my computer.

I tried from a different laptop same results no log in using Firefox, I have cleared Cache and cookies, DNS, History. It doesn't matter if I enter the correct password or a wrong password same result dial spins then returns to blank log in fields?
laptop is on same network could that be a problem, all of the sudden??
Thanks

Do the symptoms also happen on the storefront? ie: to customers trying to login to their account? or to add things to their shopping basket?

What's the URL?
What plugins are installed?
When you click Reply below, please answer the first 10 questions in the Posting Tips section.

version 1.5.1 have upgraded every upgrade started fresh with 1.3.8
PHP-5.3.21 MySQL- 5.0.96-community-log
Have added recover cart sales, image handler 4, email archive manager, google merchant center feed, easy populate 4, sitemap XLM.
installed by FTP upload

Problem just started after host renewed SSL Cert. I have been in contact with them also.

I logged in as customer with no problem.
I noticed in my lastest vistor log when I try to log in referrer- https://ww w.smokinhumidors.com/renamedadmin/login.php.....
then I see http code 302
and then http://smokinhumidors.com/renamedadmin/log..... with no https or www
includes/config. set:
define('HTTP_SERVER', 'http://www.smokinhumidors.com');
define('HTTPS_SERVER', 'https://www.smokinhumidors.com');
// Use secure webserver for checkout procedure?
define('ENABLE_SSL', 'true');

admin/config.
define('HTTP_SERVER', 'https://www.smokinhumidors.com');
define('HTTPS_SERVER', 'https://www.smokinhumidors.com');
define('HTTP_CATALOG_SERVER', 'http://www.smokinhumidors.com');
define('HTTPS_CATALOG_SERVER', 'https://www.smokinhumidors.com');
// secure webserver for admin? Valid choices are 'true' or 'false' (including quotes).
define('ENABLE_SSL_ADMIN', 'true');
// secure webserver for storefront? Valid choices are 'true' or 'false' (including quotes).
define('ENABLE_SSL_CATALOG', 'true');

Aslo have a .htaccess in root:

RewriteEngine on

Options -Indexes

redirects any URL that includes: record_company.php/password_forgotten.php

RedirectMatch Permanent ^/(.*[record_company.php]+)/(password_forgotten.php)$ /page_not_found.php

redirects any URL that includes: /images/wp- with 'wp-' being anything that ends with '.php'

this allows for images named such as 'wp-header.jpg' to work

RedirectMatch Permanent ^/(.[images]+)/(wp-..php)$ /page_not_found.php

ErrorDocument

ErrorDocument 404 /index.php?main_page=page_not_found

Canonical Redirect non-blank, non-www and/or appended port number to www [EXCLUDE /admin requests]

RewriteCond %{HTTP_HOST} !^(www.smokinhumidors.com)?$
RewriteCond %{REQUEST_URI} !^/admin [NC]
RewriteRule (.*) http://www.smokinhumidors.com/$1 [R=301,L]

<Files 403.shtml>
order allow,deny
allow from all
</Files>

RewriteCond %{HTTP_REFERER} !^$
RewriteCond %{HTTP_REFERER} !^http://smokinhumidors.com/.$ [NC]
RewriteCond %{HTTP_REFERER} !^http://smokinhumidors.com$ [NC]
RewriteCond %{HTTP_REFERER} !^http://www.google.com/.$ [NC]
RewriteCond %{HTTP_REFERER} !^http://www.google.com$ [NC]
RewriteCond %{HTTP_REFERER} !^http://www.shopwiki.com/.$ [NC]
RewriteCond %{HTTP_REFERER} !^http://www.shopwiki.com$ [NC]
RewriteCond %{HTTP_REFERER} !^http://www.smokinhumidors.com/.$ [NC]
RewriteCond %{HTTP_REFERER} !^http://www.smokinhumidors.com$ [NC]
RewriteCond %{HTTP_REFERER} !^http://www.thefind.com/.$ [NC]
RewriteCond %{HTTP_REFERER} !^http://www.thefind.com$ [NC]
RewriteCond %{HTTP_REFERER} !^https://smokinhumidors.com/.$ [NC]
RewriteCond %{HTTP_REFERER} !^https://smokinhumidors.com$ [NC]
RewriteCond %{HTTP_REFERER} !^https://www.smokinhumidors.com/.$ [NC]
RewriteCond %{HTTP_REFERER} !^https://www.smokinhumidors.com$ [NC]
RewriteCond %{HTTP_REFERER} !^http://www.paypal.com/.$ [NC]
RewriteCond %{HTTP_REFERER} !^http://www.paypal.com$ [NC]
RewriteCond %{HTTP_REFERER} !^https://www.paypal.com/.$ [NC]
RewriteCond %{HTTP_REFERER} !^https://www.paypal.com$ [NC]
RewriteRule ..(jpg|jpeg|gif|png|bmp)$ - [F,NC]

Your rewrite rules in root .htaccess might be problematic. Try renaming it to htaccess_OFF temporarily. Does that resolve your admin login problem? If so, then your "exclude /admin requests" rule needs to be updated to match your real admin foldername.

Also, did your old SSL certificate point to "smokinhumidors.com" instead of "www.smokinhumidors.com" ? Does the new one support both? (most new ones do nowadays and if they don't then they should be re-issued). Did the old one support both?

I renewed my SSL from last year both are "www.smokinhumidors.com" I will turn rename htaccess. if that works would i just change RewriteCond %{REQUEST_URI} !^/admin [NC] to the actual admin name?
I really appreciate your help. Thank you very much.

sham:

I will turn rename htaccess. if that works would i just change RewriteCond %{REQUEST_URI} !^/admin [NC] to the actual admin name?
Yes, I think that would do it.

unfortunately renamed the htaccess did not help renamed to htaccess_old closed all browsers cleared history and cache and still had the same problem.
Guess I will have to keep digging maybe host can come up with something. I have thought about a redesign and fresh install anyway maybe this is a sign?
Thanks for you help, I will keep you posted if I find a fix.

If I were to tell you to look at the cookies that are being set in Firefox, specifically the one for zenAdminId, would you know what I'm talking about?
If so, please look at that cookie and post back its details. I'm interested mostly in the domain part.

Then doing the same in Chrome would be helpful as a comparison.