Re: Still problems with 1.4.19 and "you must be logged in" error

>>> Description of the problem:
>>>
>>> After upgrading to 1.4.19, the only page an user will see after logging
>>> in will be the default page with the left/right frame and folders/INBOX
>>> information. Any click after this point will show a "you must be logged
>>> in" error.
>>>
>>> The only way of getting rid of this problem is deleting all cookie
>>> information from squirrelmail in your browser or reverting to 1.4.17.
>> [...]
>>>
>>> Some tecnical information about our system:
>>>
>>> - RHELS 5.3, Apache/2.2.11, PHP.5.2.8
>>> - All traffic between the browser and apache uses SSL (port 443).
>>> - Session data and userpref/addressbook are saved in a PostgreSQL
>>> database.
>>>
>>>
>>> Do you need any more information?
>>> How can we help to fix this problem?
>>
>> We need a reliable way to reproduce it.  You seem to be able to
>> reproduce it, so please explain how we can see the issue.  In
>> particular, what cookies have to be in the browser?  What browser do
>> you test with?  What about other browsers?  If you want to give
>> someone on the SM team access to your test environment, one of us
>> might be able to take a look at it there.
>>
>>
>
> I had the same issue as described above. The configuration is CentOS 5,
> Apache 2.23, PHP 5.1.6, Squirrelmail 1.4.18. I discovered that the source of
> my problem is the fact that when session.auto_start is true session_name()
> doesn't set/get the cookie name actually used for sessions.

SM 1.4.x is not compatible with session.auto_start.  If you run
configtest after you configure SM, you'd see that.  This is not a bug
and is the way the product works.  The OP of this issue didn't state
if that was his problem, and if not, it might have something to do
with storing session data in a database.

> My browser is Firefox 3.5. Here is what happens when session.auto_start is
> true and I start with no cookies:
> - browser sends request for src/login.php
> - the server response sets two cookies, both with the same value:
>
>  Set-Cookie: PHPSESSID=loa39oksk3kpojavvibmic5p57; path=/
>  Set-Cookie: SQMSESSID=loa39oksk3kpojavvibmic5p57; path=/; HttpOnly
>
> - browser sends username and password to src/redirect.php; it sends back
> both cookies
>
>  Cookie: PHPSESSID=loa39oksk3kpojavvibmic5p57;
> SQMSESSID=loa39oksk3kpojavvibmic5p57
>
> - the server response, a redirect to src/webmail.php (so I was authenticated
> successfully), contains multiple Set-Cookie, the final cookie being created
> by session_regenerate_id():
>
>  Set-Cookie: SQMSESSID=loa39oksk3kpojavvibmic5p57; path=/; HttpOnly
>  [the above line repeated a few times]
>  Set-Cookie: squirrelmail_language=en_US; expires=Sat, 01-Aug-2009 14:08:02
> GMT; path=/; HttpOnly
>  Set-Cookie: SQMSESSID=po918qludujgo9hmrsj1pj5h23; path=/
>  Set-Cookie: SQMSESSID=po918qludujgo9hmrsj1pj5h23; path=/; HttpOnly
>  [the above line repeated a few times]
>  Set-Cookie: key=ptY6xwMHCNY%3D; path=/; HttpOnly
>  Set-Cookie: SQMSESSID=po918qludujgo9hmrsj1pj5h23; path=/; HttpOnly
>  [the above line repeated a few times]
>
> - the browser requests src/webmail.php, sending back the old session id in
> PHPSESSID and the new one in SQMSESSID:
>
>  Cookie: PHPSESSID=loa39oksk3kpojavvibmic5p57;
> SQMSESSID=po918qludujgo9hmrsj1pj5h23; squirrelmail_language=en_US;
> key=ptY6xwMHCNY%3D
>
> - server response tells me that I need to log in first and sends back the
> old session id:
>  Set-Cookie: SQMSESSID=loa39oksk3kpojavvibmic5p57; path=/; HttpOnly
>
> The on disk session files are OK:
> - the old session, with id loa39oksk3kpojavvibmic5p57, has the usual content
> for unauthenticated users
> - the new session, with id po918qludujgo9hmrsj1pj5h23, has the content for
> authenticated users
>
> I started to suspect that php gets the session id from the PHPSESSID cookie
> and ignores the SQMSESSID cookie. I searched if this is a known issue and I
> found that others had the same issue:
> http://bugs.php.net/bug.php?id=35233
> https://bugzilla.wikimedia.org/show_bug.cgi?id=3990
>
> In my case the solution was to either set session.auto_start to false or to
> make in functions/global.php and include/validate.php the same code change
> as in MediaWiki, i.e. don't set session_name if session.auto_start is true.
>
> I hope that helps you to reproduce the problem and make a fix.

No "fix" for this is intended.  Please run src/configtest.php before
you try to use SquirrelMail.

-- 
Paul Lesniewski
SquirrelMail Team
Please support Open Source Software by donating to SquirrelMail!
http://squirrelmail.org/donations.php

------------------------------------------------------------------------------
-----
squirrelmail-devel mailing list
Posting guidelines: http://squirrelmail.org/postingguidelines
List address: [email protected]
List archives: http://news.gmane.org/gmane.mail.squirrelmail.devel
List info (subscribe/unsubscribe/change options): https://lists.sourceforge.net/lists/listinfo/squirrelmail-devel