"There was a security error when trying to login" - v1.3.8

DrByte:

FAQ on the "security error when trying to login" issue:
https://www.zen-cart.com/tutorials/index.php?article=312

I read the FAQ but it is not quite for my problem.

I am a ZC newbie. I did my first install on Nov. 30, so by chance, I started with v1.3.8. I did the install with SSL 'false' in the various files because the SSL certificate I'd just purchased hadn't been installed yet. Everything went very well, and the login process was functioning correctly.

Today, with my SSL certificate in place, I went about installing the Google Checkout payment module. I customized various "login" files, and I changed those SSL 'false' lines to 'true'.

Then I discovered the "There was a security error when trying to login" problem.
At first I thought I'd erred in the SSL settings. But having read this thread, I think the Google module I downloaded from Google.com lacks the new "security token" portions in the files:

• /includes/templates/YOUR_TEMPLATE/templates/tpl_login_default.php
• /includes/templates/YOUR_TEMPLATE/templates/tpl_timeout_default.php
  (and (?) /admin/login.php).

Since I'm new, started with v1.3.8, have nothing old to copy from, and am not much of a programmer, I really don't know what code I need to insert into those files, and exactly where I should insert it. I'm also not 100% sure that my SSL setting is unrelated to the problem.

I would greatly appreciate any advice.

Thanks!

Your URL?

Hmmm... After upgrading from 1.3.7.1 I am having this problem with my admin login. The user login works fine and all the data in mysql seems to have transfered over fine.

I checked, and my admin/login.php file is exactly the same as the one that 1.3.8 came with.

Any ideas? :(

Here's the link I am using:

http://birdingdepot.com

You need to add a "/demo" to that link to see my site in 1.3.8. I didn't want to add it because the next thing I know Google will index it!! :)

Try clearing your browser cache and cookies.

Thank for the tip, but unfortunately it didn't work. I tried it with several browsers, on two computers, cleared the cache and cookies. No dice... :( It won't let me log on to admin.

Yeah! I think I figured it out.

Since I was using a test site in a different directory, I had to change a lot of lines in my configure.php to reflect this directory. I only changed the first four. After changing all 7, it worked like a charm! :)

Thanks for the update.

Any reason why the new tpl_login_default.php is an older build than the the one written by DrByte in June this year?

numinix:

Any reason why the new tpl_login_default.php is an older build than the the one written by DrByte in June this year?

It's because the new securityToken feature was built in February, but other fixes built earlier were included for the June PayPal patch and released as part of the July v1.3.7.1 release. There has been no need to update the v1.3.8 edition of the file since February.
It's a lot of fun keeping multiple software versions in sync. :smile:

That's why we got the mastermind DrByte ;)

Btw, for those who have blank login pages, it may be something to do with create_account.php found in the modules folder. This file needs to be merged with the latest version if you have the CAPTCHA module installed.

I am getting this error when I try the login via the login sidebox module addon. Whoever is going to update this module for 1.3.8 may want to add the security token to the code and that of course should fix this problem.

to fix, change this line:

$content .=LOGIN_BOX_PASSWORD . '<br />' . zen_draw_password_field('password', '', 'size="13"') . '<br />';

to:

$content .=LOGIN_BOX_PASSWORD . '<br />' . zen_draw_password_field('password', '', 'size="13"') . zen_draw_hidden_field('securityToken', $_SESSION['securityToken']) . '<br />';

that just adds the security token in there.

I had the same problem after I installed the Google checkout Mod to 1.3.8.

Go to:
/includes/templates/YOUR_TEMPLATE/templates/tpl_login_default.php

and find:

<label class="inputLabel" for="login-password"><?php echo ENTRY_PASSWORD; ?></label>

The bold lines above are removed when you add the Google checkout mod.
Check your file and if it is missing simply copy the bold lines above back into your file and you should be able to log back into the customer area!

The same will go for the following file:

/includes/templates/YOUR_TEMPLATE/templates/tpl_timeout_default.php

It will be missing this line:

<?php echo zen_draw_hidden_field('securityToken', $_SESSION['securityToken']); ?>

This is what it should look like:

<label class="inputLabel" for="login-password"><?php echo ENTRY_PASSWORD; ?></label>

The login sidebox contribution was updated earlier to include the securityToken.

The tpl_timeout_default.php template file included in v1.3.8 already contains the securityToken. If yours doesn't, then you've not done a thorough upgrade.

I am also stuck on this. I have replaced both of the above mentioned files (though this has been an obtuse thread - no mention of a practical solution - until page 6, and btw the FAQ merely restates the problem with no help!)
Despite replacing them with fresh copies from the install, i still get the same security error on customer log-in. Any further suggestions?

johnga:

I am also stuck on this. I have replaced both of the above mentioned files (though this has been an obtuse thread - no mention of a practical solution - until page 6, and btw the FAQ merely restates the problem with no help!)
Despite replacing them with fresh copies from the install, i still get the same security error on customer log-in. Any further suggestions?

Please list the names of all the files in your custom template folder, ie: /includes/templates/NAME_OF_YOUR_TEMPLATE/templates

BTW these problems are on holidaytoyexpress.com. I am waiting until I solve them to upgrae my other site!
These are the files :
tpl_about_us_default.php
tpl_checkout_confirm.php
tpl_checkout_payment.php
tpl_checkout_shipping.php
tpl_checkout_success.php
tpl_login_default.php
tpl_modules_product_listing.php
tpl_time_out_default.php

and I just found these in there:

tpl_gc_return_display.php
tpl_gc_return_noproduct.php
tpl_shopping_cart_default.php

johnga:

BTW these problems are on holidaytoyexpress.com. I am waiting until I solve them to upgrae my other site!
These are the files :
tpl_about_us_default.php
tpl_checkout_confirm.php
tpl_checkout_payment.php
tpl_checkout_shipping.php
tpl_checkout_success.php
tpl_login_default.php
tpl_modules_product_listing.php
tpl_time_out_default.php

... and I just found these in there:

tpl_gc_return_display.php
tpl_gc_return_noproduct.php
tpl_shopping_cart_default.php

Okay ... and have you done an upgrade of ALL of THOSE files, by comparing them to the matching filenames in the template_default/templates folder, using a tool like WinMerge?

Well, I just downloaded TextWrangler , because I am a Mac user. But having never used it before, I will have to spend some time learning how to make it work. The mystery is:
What exactly am I looking for? Once I compare my files, am I looking for something that is not in my files that should be, or am I looking for something that is in my files that shouldn't be. Is there an explanation of what this new security feature does and which files it involves so people that don't know a lot about coding stand a chance of finding where they went wrong?