[Done v1.6.0] Timeout during final step of checkout - Solution?

After many hours of debugging this problem (session timeout error after pressing confirm button during checkout):

http://www.zen-cart.com/showthread.php?211226-Session-randomly-expiring-on-final-step-of-checkout-process/page2

using lat9's notifier trace plugin and a lot of custom notifiers, I found that the error is caused when a comma or dash has been inserted into the sessionid, as it then fails these three tests in sessions.php:

Line #121 : if (preg_replace('/[a-zA-Z0-9]/', '', session_id()) != '')

Line #154 : if (preg_replace('/[a-zA-Z0-9]/', '', $tempSessid) != '')

Line #170 : if (preg_replace('/[a-zA-Z0-9]/', '', $tempName) == '') return session_name($name);

Should these regular expressions include commas and dashes? The php setup I have with dreamhost seems to include them sometimes, and I found in the php manual that they can be included in session ids: http://php.net/manual/en/function.session-id.php.

Also, I find it a little strange that zen_session_id is only called on the final step of the checkout, as using the notifier trace plugin I noticed that the sequence for checkout_process (which makes sense according to init_sessions.php) is:

zen_session_name -> makes sense called on line 34
zen_session_save_path -> makes sense called on line 35
zen_session_name -> makes sense called on line 53 or 55
zen_session_name-> makes sense called on line 54 or 56 (nested inside zen_session_id)
zen_session_id -> makes sense called on the outer of zen_session_name

(line numbers might be off since I added notifiers)
but the sequence for going from either shipping to payment or payment to confirmation is this:

zen_session_name -> makes sense called on line 34
zen_session_save_path -> makes sense called on line 35
zen_session_name
zen_session_name

but it is missing the zen_session_id call. So the two ifs must be triggering these two function calls since zen_session_id is never called:

if (isset($_POST[zen_session_name()])) {
zen_session_id($_POST[zen_session_name()]);
} elseif ( ($request_type == 'SSL') && isset($_GET[zen_session_name()]) ) {
zen_session_id($_GET[zen_session_name()]);
}

Is there a reason it is only called on checkout_process? Anyways, this is the reason that the error only occured on the final step of checkout, and why the error appeared to be random (since the session ids are generated at random). On a final note, I noticed that session_regenerate_id(); in function zen_session_recreate was sometimes adding in the commas and dashes in the session id.

Sorry for the long post, but I hope those many hours of debugging helps someone!

Kyle

How's about spending a few more minutes to answer as many of the posting tips as you can? That will help us to help you.

Hi dbltoe I was mainly posting what I believed to be a solution and asking for comments regarding the validity of the solution, although I guess I should have included the regular expression to solve the issue. But if you think it is more an issue with my hosting that needs debugging rather than the session handling functions in zencart then my php mode is 5.3.x fastcgi and as mentioned my hosting company is dreamhost. I thought I included a pretty detailed explanation of my debugging (kind of annotated debug log) along with the specific code that is causing the issue, and why it is causing it when (including the exact sequence of functions being executed). If you look into the code I think you will see exactly what I am talking about, and why it might need to be changed. Not sure what else you would need than that, but let me know if you need any more info.

Thanks for replying so quickly!

Here is the code causing the immediate issue for me, although the other preg_replace checks I beleive should also be changed:

function zen_session_id($sessid = '') {
if (!empty($sessid)) {
$tempSessid = $sessid;
if (preg_replace('/[a-zA-Z0-9]/', '', $tempSessid) != '') <- returns true when comma or dash is left so a new sessid is created
{
$sessid = md5(uniqid(rand(), true));
}
return session_id($sessid);
} else {
return session_id();
}
}

You see, the reason for the posting tips is to find out what is different from your 1.5.0 from all the others that are working. Granted, dreamhost may be part of the problem but, the code you just posted is not showing up for me in a search of standard 1.5.0 files. Also, preg_replace is deprecated and no longer used.
Part of the tips asks what mods are installed. One of your installed mods just might contain the code you posted. Perhaps you have some mod to the checkout process?
However, without the info, I'm at a loss to do much more for you.

dbltoe:

... Also, preg_replace is deprecated and no longer used.
Slight correction: The \e modifier to preg_replace (http://php.net/manual/en/function.preg-replace.php) is deprecated, but not the preg_replace function itself. You might have been thinking of ereg_replace which was deprecated as of PHP 5.3.0.

Need to read a little closer next time.:blush:

Still, code not found in standard ZC files.:(

Hi dbltoe,

As mentioned in my first post the code is located in includes/functions/sessions.php, and I believe in all of the modern versions from 1.3.x to 1.6. If you are having trouble finding it you can just look up the function zen_session_id (in my third post) or zen_session_start or zen_session_name which are all 3 functions which have the preg_replace. Or you can even search for preg_replace('/[a-zA-Z0-9]/' to find the three exact lines it is used.

My proposed fix is to change this:

preg_replace('/[a-zA-Z0-9]/'

to this:

preg_replace('/[a-zA-Z0-9,-]/'

but I need to brush up on my regex to make sure.

:blush::blush:I use UltraFind which is a great program UNTIL you forget that the last time you used it you were looking for a png file. Naturally, it was not finding any of the preg_replace used in naming any png file in 1.5.0:blush::blush:

SO.... Now we're beyond the point of ferreting out info AND the point of my expertise in the area.

Or, if you are able to use it, try http://preg_replace.onlinephpfunctions.com/ to test your theory.

Hopefully lat9 can help with the code.

dbltoe:

:blush::blush:I use UltraFind which is a great program UNTIL you forget that the last time you used it you were looking for a png file. Naturally, it was not finding any of the preg_replace used in naming any png file in 1.5.0:blush::blush:

SO.... Now we're beyond the point of ferreting out info AND the point of my expertise in the area.

Or, if you are able to use it, try http://preg_replace.onlinephpfunctions.com/ to test your theory.

Hopefully lat9 can help with the code.
I've got to start keeping a list of sites you're posting, what a great tool!

Using that, it looks like gunnzo's proposal for the preg_replace (er) replacement string does what's needed (i.e. checking that the session ID contains only alphanumeric characters and/or minus signs).

lat9:

I've got to start keeping a list of sites you're posting, what a great tool!
I often say, "Necessity is Not the Mother of invention. It's laziness!":P

gunnzo:

My proposed fix is to change this:

preg_replace('/[a-zA-Z0-9]/'

to this:

preg_replace('/[a-zA-Z0-9,-]/'

but I need to brush up on my regex to make sure.
Yes, that regex pattern will indeed allow comma and hyphen to be considered as acceptable characters. The important thing about using the hyphen in that sort of pattern is that it is the last character in the list, or it is escaped with a backslash.

Another good testing site for regex patterns is http://regexpal.com

gunnzo:

my php mode is 5.3.x fastcgi
In your php.ini (or from phpinfo() or the Admin->Tools->Server Info screen) what is your setting for session.hash_bits_per_character

6 instead of php's default 4.

I suppose dreamhost must have this set as default instead for some reason. I noticed that someone mentioned in a comment on the php.net manual about session_id that this could cause the session id to have a minus or comma. I noticed several other threads on the zencart forum where this could have been the issue. I also noticed after a little bit more research on Google that several other cms's have had the same issue (SMF, os_commrce:http://forums.oscommerce.com/tracker/issue-601-sessionhash-bits-per-character6-will-lead-to-intermittent-insane-session-ids/ (the % he is talking about is probably a %2c aka a comma)).

Are there any downsides to including the comma and minus to make it compatible with these set ups?

Thanks for your help dbltoe, lat9 (also thanks for the notifier plugin), and DrByte!

gunnzo:

Are there any downsides to including the comma and minus to make it compatible with these set ups?
I don't see any downsides, but haven't done any testing. Need to study the code history to determine when and why that regex was put there (I think it's fairly self-evident, but need to be sure), just to ensure there aren't any related knock-on side-effects, or other places where code needs to be looked at.

Are you on github? Do you mind submitting a Pull Request for that against https://www.github.com/zencart/zencart in the v160 branch

Sure, I think I did it right, but if not let me know.

Looks good. Will let the others chime in through the week before it can be merged.
Thanks for doing that.

And thanks for doing the research and debugging to find the relevant fix too!

Merged into v1.6.0

"Fix" combined into instructions for edits to make on older versions: http://www.zen-cart.com/showthread.php?215694&p=1270902#post1270902

Glad I could help my favorite open source software I have been using for 6+ years! Thanks for keeping it going.