Re: Still problems with 1.4.19 and "you must be logged in" error

Paul Lesniewski wrote:
> 
> 
>> Description of the problem:
>>
>> After upgrading to 1.4.19, the only page an user will see after logging
>> in will be the default page with the left/right frame and folders/INBOX
>> information. Any click after this point will show a "you must be logged
>> in" error.
>>
>> The only way of getting rid of this problem is deleting all cookie
>> information from squirrelmail in your browser or reverting to 1.4.17.
> [...]
>>
>> Some tecnical information about our system:
>>
>> - RHELS 5.3, Apache/2.2.11, PHP.5.2.8
>> - All traffic between the browser and apache uses SSL (port 443).
>> - Session data and userpref/addressbook are saved in a PostgreSQL
>> database.
>>
>>
>> Do you need any more information?
>> How can we help to fix this problem?
> 
> We need a reliable way to reproduce it.  You seem to be able to
> reproduce it, so please explain how we can see the issue.  In
> particular, what cookies have to be in the browser?  What browser do
> you test with?  What about other browsers?  If you want to give
> someone on the SM team access to your test environment, one of us
> might be able to take a look at it there.
> 
> 

I had the same issue as described above. The configuration is CentOS 5,
Apache 2.23, PHP 5.1.6, Squirrelmail 1.4.18. I discovered that the source of
my problem is the fact that when session.auto_start is true session_name()
doesn't set/get the cookie name actually used for sessions.

My browser is Firefox 3.5. Here is what happens when session.auto_start is
true and I start with no cookies:
- browser sends request for src/login.php
- the server response sets two cookies, both with the same value:

  Set-Cookie: PHPSESSID=loa39oksk3kpojavvibmic5p57; path=/
  Set-Cookie: SQMSESSID=loa39oksk3kpojavvibmic5p57; path=/; HttpOnly

- browser sends username and password to src/redirect.php; it sends back
both cookies

  Cookie: PHPSESSID=loa39oksk3kpojavvibmic5p57;
SQMSESSID=loa39oksk3kpojavvibmic5p57

- the server response, a redirect to src/webmail.php (so I was authenticated
successfully), contains multiple Set-Cookie, the final cookie being created
by session_regenerate_id():

  Set-Cookie: SQMSESSID=loa39oksk3kpojavvibmic5p57; path=/; HttpOnly
  [the above line repeated a few times]
  Set-Cookie: squirrelmail_language=en_US; expires=Sat, 01-Aug-2009 14:08:02
GMT; path=/; HttpOnly
  Set-Cookie: SQMSESSID=po918qludujgo9hmrsj1pj5h23; path=/
  Set-Cookie: SQMSESSID=po918qludujgo9hmrsj1pj5h23; path=/; HttpOnly
  [the above line repeated a few times]
  Set-Cookie: key=ptY6xwMHCNY%3D; path=/; HttpOnly
  Set-Cookie: SQMSESSID=po918qludujgo9hmrsj1pj5h23; path=/; HttpOnly
  [the above line repeated a few times]

- the browser requests src/webmail.php, sending back the old session id in
PHPSESSID and the new one in SQMSESSID:

  Cookie: PHPSESSID=loa39oksk3kpojavvibmic5p57;
SQMSESSID=po918qludujgo9hmrsj1pj5h23; squirrelmail_language=en_US;
key=ptY6xwMHCNY%3D

- server response tells me that I need to log in first and sends back the
old session id:
  Set-Cookie: SQMSESSID=loa39oksk3kpojavvibmic5p57; path=/; HttpOnly

The on disk session files are OK:
- the old session, with id loa39oksk3kpojavvibmic5p57, has the usual content
for unauthenticated users
- the new session, with id po918qludujgo9hmrsj1pj5h23, has the content for
authenticated users

I started to suspect that php gets the session id from the PHPSESSID cookie
and ignores the SQMSESSID cookie. I searched if this is a known issue and I
found that others had the same issue:
http://bugs.php.net/bug.php?id=35233
https://bugzilla.wikimedia.org/show_bug.cgi?id=3990

In my case the solution was to either set session.auto_start to false or to
make in functions/global.php and include/validate.php the same code change
as in MediaWiki, i.e. don't set session_name if session.auto_start is true.

I hope that helps you to reproduce the problem and make a fix.

-- 
View this message in context: http://www.nabble.com/Still-problems-with-1.4.19-and-%22you-must-be-logged-in%22-error-tp23851401p24307818.html
Sent from the squirrelmail-devel mailing list archive at Nabble.com.


------------------------------------------------------------------------------
-----
squirrelmail-devel mailing list
Posting guidelines: http://squirrelmail.org/postingguidelines
List address: [email protected]
List archives: http://news.gmane.org/gmane.mail.squirrelmail.devel
List info (subscribe/unsubscribe/change options): https://lists.sourceforge.net/lists/listinfo/squirrelmail-devel