"There was a security error when trying to login" - v1.3.8

I shall give that a go, thanks. Have to work today but will post when I have tried it to see if it works!

indicana:

How do I compare the remote files using Winmerge? I am experiencing the same login error problem for returning customers. I get the message"there was a security error when trying to login" when I login as a returning customer. Ever since I uploaded my customised header on the newly installed zencart template "Slovak_Classic" I am facing this login error problem. I would really appreciate if you could help me find a solution to this problem. I am stuck because of this.

I downloaded the software Winmerge after reading the forums, but can't figure out how to view the remote files using winmerge as the browse button opens the folders on my PC only.

Indicana

Whenever I've done a compare, I've always done a full download of all the files from my website using FTP. Then do the compare. This doubles as a backup of all my website files (I can zip them up or burn to a CD etc), which is an even more important upgrade step than comparing! Should also do a database-backup while you're at it. See the FAQs area for backup tips.

I am still getting the above error.
I am not updating as I started with the most recent version.
Customer login was fine and then this error started.
I have done the cross check on the two files mentioned and they have not changed.
Is there anything else you can recommend to fix this problem.

crisand:

my customer login was fine one day and not the next.
...
the only thing I did do was the 'Steps in securing your Zen Cart store' , and then customer login stopped working giving me the security error.
I have compared the tpl_time_out & tpl_login_default with an older backup and they look fine, can you suggest somewhere else to look?

crisand:

I am still getting the above error.
...
Customer login was fine and then this error started.

...

Is there anything else you can recommend to fix this problem.

Maybe you need to undo the changes you said you did make, to see what part of those changes is causing the problem for your particular site and server configuration.

Hi,
This is what I changed.
-I renamed my /admin folder
-I set my /includes/configure.php file to 444 and am now not able to change back to 644 without an error message coming up on my site. While it is changed I did try to login as a customer with no luck.

• I had moved my /cache folder but moved it back.
  And I honestly haven't done anything else thats why I am so confused, not being a computer buff doesn't help either.
  If there is anything else you can recommend it would be very much appreciated.

Is your cache folder writable?
Did you change any .htaccess files?
What version of PHP is on your server?
What are your settings in Admin->Configuration->Sessions? Have you changed any from the defaults? If so, why?
Who are you hosted with?
What is your URL?
If you set ENABLE_SSL to 'false', does it change anything?

If you install a new copy of Zen Cart in another folder+database, do these same problems happen?

Is your cache folder writable? - I changed this from 777 to 755
Did you change any .htaccess files? - Not that I am aware of, I stay away from anything I don't need to touch.
What version of PHP is on your server? 5.2.5
What are your settings in Admin->Configuration->Sessions? Have you changed any from the defaults? If so, why? - Didn't change anything here unless it said to in the manual.
Who are you hosted with? - MD Web hosting Australia
What is your URL? http://www.thelittleonlinecardshop.com.au
If you set ENABLE_SSL to 'false', does it change anything? It is set to false anyway, so I am not sure about this.

If you install a new copy of Zen Cart in another folder+database, do these same problems happen? _ I have no idea how you mean to do this, sorry.
This is the error on my site when includes/configure.php is changed to 644
Warning: I am able to write to the configuration file: /home/thelittl/public_html/includes/configure.php. This is a potential security risk - please set the right user permissions on this file (read-only, CHMOD 644 or 444 are typical). You may need to use your webhost control panel/file-manager to change the permissions effectively. Contact your webhost for assistance. See this FAQ
Sorry, I am not much help I know.

Doesn't seem to be an SSL problem with your site, it is with your Hoster.

From the looks of things, they are providing you with a Shared SSL Cert which expired.

Cert Issued to: https://www.dividends.net.au
Expired: 10/09/2007

It has nothing to do with 644 or 444 on your configure.php files.

Whatever is causing it is preventing your visitors from being able to establish a PHP session. You can't even add anything to the cart and have it be remembered. That's a classic problem with sessions.

When did your hosting company upgrade to PHP 5.2.5? Maybe they busted this on you without knowing it.

Thanks to both of you, I have put these points to my hosting co. and await a reply! I thought everything was going so well as well.
Much appreciated.

Hi,
My hosting company says it is definitely an error at my end.
A friend has been helping and has suggested these things which I have done.
Firstly to download a new version of Zen and give it a name. I did this brought up the new site signed up and then tried to login, with no luck.
I have deleted and then transferred my backup from prior to the error on the following files -
includes/functions/sessions.php
includes/languages/english/login.php
includes/templates/YOUR_TEMPLATE/templates/tpl_login_default.php
includes/templates/YOUR_TEMPLATE/templates/tpl_timeout_default.php
Would you have any other suggestions that might fix this ongoing problem?
My site has not been working for 3 weeks now so I am desperate to get it working, and you guys seem to know more about what to do than MD.
With much thanks once again.

Hosting companies often say things like this. Many times it just means "I've had a quick look and couldn't see anything obvious at this end". Occasionally they go deeper in which case they will hopefully have provided some explanation as to why they believe that it is definitely a problem at your end, in which case please share that explanation since it may be helpful in diagnosing your problem.

Also, I notice that you haven't answered DrByte's question about the timing of the PHP upgrade to 5.2.5. We're interested in its proximity to the start of these problems.

Problem seems to have started when you switched Templates.
What happens when you switch to using the Classic Template?

If all else fails you could make a post in the Commercial Section of the Forum. Usually faster to have an experienced eye have a look at things first-hand, when it comes to solving certain problems such as situations like this.

The PHP version is the same as when I joined, so there was no upgrade.
My template upgrade was done a couple of months before this happening.
I shall phone them tomorrow, emailing is taking way too long with their response at least 48hrs after I send through details.

For customized templates, all you need to do is add this new Security Feature to 2 files tpl_login_default.php and tpl_time_out_default.php

Find the text "<label class="inputLabel" for="login-password"><?php echo ENTRY_PASSWORD; ?></label>" in both file tpl_login_default.php & tpl_time_out_default.php and add "<?php echo zen_draw_hidden_field('securityToken', $_SESSION['securityToken']); ?>"

below the "<br class="clearBoth" />" (2-3 lines under)

That will do the trick.

thankyou! saved my bacon! The security addition worked for me!

Hi, I have a very similar problem. After upgrading my customers were unable to log in. However after adding the new security token code to the timeout and login files "<?php echo zen_draw_hidden_field('securityToken', $_SESSION['securityToken']); ?>" it seemed to have worked. However, it only works if the customer logs in before they add an item to the shopping cart. If they log in after (where it shows a different page) they can still log in but it shows a black banner and error symbol where the security log in error used to display! Any ideas? It's great that they can now log in but no customer is going to appreciate what looks like an error come up when they log in the complete a purchase! Please help, the url to my site is as below. Many thanks!

http://www.ethicsandgrace.co.uk/shop/index.php?main_page=shopping_cart

I forgot to say, if the customer then refreshes the shopping cart page the black error banner disappears! Thanks

Hi folks,

I have read the entire thread and done all the changes and I still get this "There was a security error when trying to login." when i log in. As I am using a bought template the errors occurs.

I installed a fresh clean copy of zen 1.3.8a on a testing domain and it all works fine and its on the same server the broken one is on, so its the same version of php etc

Should I now talk to the template company now or ask the hosting company as someone earlier suggested.

Thanks

Ellie

elliesupport:

Hi folks,

I have read the entire thread and done all the changes and I still get this "There was a security error when trying to login." when i log in. As I am using a bought template the errors occurs.

I installed a fresh clean copy of zen 1.3.8a on a testing domain and it all works fine and its on the same server the broken one is on, so its the same version of php etc

Should I now talk to the template company now or ask the hosting company as someone earlier suggested.

Thanks

EllieThe hosting company won't be able to help you. The template clearly hasn't been written for the current version of Zen Cart. However, this thread should contain all the information that you need to solve the problem, so it's most likely a problem with the way in which you have made the changes, but we'd need more information about your template and how precisely your have made the changes to help your further.