There was a security error when trying to login

I have an issue with not being able to log in after creating an account ("There was a security error when trying to login"). I did a full 3.8 install and updated the necessary files to 3.8a.

When I create an account, I can successfully place an order but I cannot log back in after logging off, even using the "forget password" feature.

Where should I look?

This issue is discussed in the following tutorial. It's related to customized files in your template:
https://www.zen-cart.com/tutorials/index.php?article=312

Related thread:
http://www.zen-cart.com/forum/showthread.php?t=84197

Looks like that was it. Thanks again! :)

Situation:

I have just upgraded and now getting this error when trying to login from the customer screen "There was a security error when trying to login"

Cause:

Zen Cart™ v1.3.8 has an added security feature to prevent spoofed external logins. A "security token" field has been added to all login forms. This token must be current (not expired), and must be submitted with login username+password in order for logins to work properly.

Remedy:

If you have customized template "login" files, the new security features need to be merged into your customized template files.

The following files are affected:

• /includes/templates/YOUR_TEMPLATE/templates/tpl_login_default.php
• /includes/templates/YOUR_TEMPLATE/templates/tpl_timeout_default.php

And if you're encountering it in your Admin area, this file is affected as well:

• /admin/login.php

Additionally, if you have customized your /includes/functions/sessions.php file for some reason, you'll also need to merge the new changes for this core file into your customized version.

I am getting this error message when trying to login to the store admin. I have tried logging in as a customer and all seems fine. I raised the issue as a support ticket with my web hosting but they have only reached the above point with me so far. Obviously, the first part of this relates to customers and I didn't customise those files anyway.

However, even though I didn't customise this file
And if you're encountering it in your Admin area, this file is affected as well:

• /admin/login.php
  I am guessing this is what is causing the problem
  Trouble is, I can't find the file to look at it or amend it!

Any help is appreciated and please remember when replying that I am stupid - therefore you need to explain things in simple terms, lol.

Other useful info,,, my web host has changed my password so many times I have no idea what it is anymore!
this was not a full install, but I upgraded through my web host cpanel (fantastico)

I am getting this error message when trying to login to the store admin. I have tried logging in as a customer and all seems fine
What do you mean? How can you login in as customer on store admin?

Did you try to copy admin/login.php from the download package, and upload it to your server?

Sorry, I wasn't very clear. I have been reading the forum and it seems a lot of people have a similar error but with regard to customer login. I have a customer account in my store and I logged into that and logged out and in again and didn't have any problems.

However, I can't get into the admin area at all. I finally located the admin/login file and have downloaded it, but I can't for the life of me see what I need to change on it. I didn't customise any of these files in the first place and I don't want to make things worse by changing anything when I don't know what I'm doing.

No, I didn't copy any file and upload, I just clicked the upgrade button in fantastico, then I reuploaded all the customised files

I just need to over-ride this security thing
TIA

If you didnt customize the admin side, you can safely download the 1.3.8a package, then upload that admin/login.php file to your server, overwrite the current one.

ScrapdragonDesigns:

this was not a full install, but I upgraded through my web host cpanel (fantastico)

Number one lesson ... don't do that !
Fantastico's upgrader is not reliable and should not be used.
A manual upgrade is always the recommended approach.

ok, bear with me cause I am stupid too :) I upgraded as well and am having the log in error. So...what you are saying is to use winmerge and put the files side by side ...my customized and the newest version of the zen file. Then i take the yellow highlighted new zen files and copy and paste them to the customized file. Then reupload??

This stuff scares me to death :) thanks for taking the time to verify this for me :)

Okay Dr Byte. This is going to sound insane, but I am hoping that you can help me. When I went to test my customer login it returned the security error mentioned above. After reading the posts I figured that the issue had to lie in tpl_login. The thin that is different about my situation is that I did a clean install of 1.3.8a. Not an upgrade. But because nothing else seemed to work I compared a new 1.3.8a tpl_login file with the one on my site using WinMerge. It turns out that the login file that was at my site was copyright 2006. The new one was 2007. I copied the new files over and it all works fine.

Here's my problem. How did the old tpl_login get there? One other material fact. Up until I added Google Checkout the login worked fine.

Any thoughts? Am I just insane?
Brad

pillaroom:

Okay Dr Byte. This is going to sound insane, but I am hoping that you can help me. When I went to test my customer login it returned the security error mentioned above. After reading the posts I figured that the issue had to lie in tpl_login. The thin that is different about my situation is that I did a clean install of 1.3.8a. Not an upgrade. But because nothing else seemed to work I compared a new 1.3.8a tpl_login file with the one on my site using WinMerge. It turns out that the login file that was at my site was copyright 2006. The new one was 2007. I copied the new files over and it all works fine.

Here's my problem. How did the old tpl_login get there? One other material fact. Up until I added Google Checkout the login worked fine.

Any thoughts? Am I just insane?
Brad

Perhaps when you added the Google Checkout one of its files busted things?
Perhaps not adding Google Checkout might be the answer? Or maybe you used the wrong version of GC files?
Or maybe asking for help in the Google Checkout support forum might be more effective?

ok, I still get a security error when trying to login into my admin. However, if I login again, it let's me in.

I did a fresh install of 1.3.8 and then used my backup database, so the admin/login.php, when comparing it old copy to new is updated. Is there somewhere else I should be looking?

mooncavecrystals:

ok, I still get a security error when trying to login into my admin. However, if I login again, it let's me in.

Is this happening on a fresh visit to the login page, or after it's sat open in a window for an extended period of time untouched?

The security token on the page expires after a period of time and requires regeneration after expiry ... thus the need to "login again" as you put it.

Ah! that could be it......since I usually keep my zen cart open most all the time....either doing work or seeing who is shopping and such. I will pay more attention and see if it is ME that is causing my paranoia :)

thanks DrB :clap:

Dr. Byte - not meaning to double post - but Kim set me on a search for recent info that might be related to my issue (you can see my original post here - http://www.zen-cart.com/forum/showthread.php?p=534871#post534871

To keep my question short - can't login if I use www in config settings - remove it and I can login. Pretty ugly with SSL.

Just a quick note - issues solved.

Thanks

That tutorial did the trick for me too! :clap:

DrByte:

This issue is discussed in the following tutorial. It's related to customized files in your template:
https://www.zen-cart.com/tutorials/index.php?article=312

Related thread:
http://www.zen-cart.com/forum/showthread.php?t=84197

I had this issue too, was using a customized tpl_login_default and have fixed it thanks to this excellent tutorial.
But I have noticed that sometimes you get the security message when using the sidebox login sidebox for the login. Sometimes you can login, sometimes not.
I' ve checked the code in the latest login box version from
http://www.zen-cart.com/index.php?main_page=product_contrib_info&cPath=40_52&products_id=154
and the code

$content .= zen_draw_hidden_field('securityToken', $_SESSION['securityToken']);

is included.
But sometimes you get the security message, sometimes it works.
Any ideas why the login box is not working reliable in 1.3.8a?