Closed pricey1981 closed 6 years ago
confirmed.
i have this issue on 3 differebt sites.
usually when image is inserted.. but i cant say thats the cause.
the text is correctly saved to db tho.
related to #1218 ?
yes, same error, different circumstances. Also, the error I'm receiving is on posting any news item, not just if image is inserted as suggested by willem010. News isn't even added to the db.
Can not really replicate ( wamp multiple php versions + live), so for time being i would suggest (only as test) to rescan plugin folders and or dbase scan.
i mixed up 2 issues.. sorry.. sometimes posting news results in an err500 but the text is saved. this usually is when images are inserted. ( and it may not be related .. but happens on the same 3 sites where this issue also happens..)
the unauthorized access issue is just like this one. no data is saved. no relation to images. (it takes a few attempts to get it to work add some persistance.. and in the end the item is posted...)
Some things to try in your e107_config.php file:
define('e_TOKEN_FREEZE', true);
If that does nothing, try this:
define('e_SECURITY_LEVEL', 0); (not recommended for production server)
There should also be an unauthorized access log in the e107_system folder, it could provide clues.
define('e_TOKEN_FREEZE', true);
added this line and it worked once, but now reverted to same issue
extract from the log file (I've removed my IP from [RemoteAddr] and [HttpXForwardedFor])
REQUEST_URI: /e107_admin/newspost.php?mode=main&action=create
e-token (POST): a3e04d19d95abfa0db5cfdf41e5c2433
_SESSION:
Array
(
[e107sess] => Array
(
[_session_validate_data] => Array
(
[RemoteAddr] =>
[HttpVia] =>
[HttpXForwardedFor] =>
[HttpUserAgent] => Mozilla/5.0 (Windows NT 10.0; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/46.0.2490.86 Safari/537.36
)
[language-list] =>
[challenge] => 57a7f8e83d546796319e12bbee2c0478073095e9
[prevprevchallenge] => 57a7f8e83d546796319e12bbee2c0478073095e9
[prevchallenge] => 57a7f8e83d546796319e12bbee2c0478073095e9
[ubrowser] => 785206e5cec747755d4c7ecee79ff9dc
[__form_token] => bcbe7ce5c9a2ea5bd73092deb256a7585654b2291950b4.74140337
[_system_messages] => Array
(
[error] => Array
(
)
[warning] => Array
(
)
[success] => Array
(
)
[info] => Array
(
)
[debug] => Array
(
)
)
[_previousUrl_expire] => 1448391536
[_previousUrl] => /e107_plugins/tinymce4/plugins/e107/parser.php
)
[_cookie_session_validate] => 1448412809
) die = true
hmmmm, now getting the same unauthorized access message when trying to disable a welcome message
Perhaps check the php info in admin to make sure session save path is okay. You could also try switching between cookies/sessions in the admin preferences area.
adding the e_token line seems to help a lot. (we will keep you posted if other errors occur)
but.. while editing the config file i did notice a weird and unfamiliar line in there.. looks llike the gfm site was / is hacked?
(@cameron.. i did send you the ftp details on the e107,org site.. if you can, check it out.. it looks like a targeted e107 hack to me?
if you want me to post a new topic on that one let me know. )
.. and more errors..
the e_token line works magic for at least 2 sites, but it ruined the gfm site.. images from the thumb.php script are no longer working.
in the media manager all thumbs are blank. all thumbs on site are no longer working.
i tried -
no results. (thumbs are created in cache folder and they seem ok.. they're just not showing)
but i guess this is going way off topic now.
edit 25-11 the server was hacked. exploit files found. probably causing all the errors on this domain. so.. for now.. do not mind the gfm issues.
@willem010 On the two websites that now work properly with the e_TOKEN_FREEZE enabled, can you check the 'session save path'? It should be listed in the About > PHP info section. Make sure that this is pointing to the right folder, and that this folder is writable.
hmm.. thats pointing to a non existent folder. let's create it and see what happens.
That should do the trick :)
The "unauthorized access" error usually occurs when e107 does not recognize your session. The session data is stored in a (temporary) folder on your server (the session save path). If this folder does not exist, the session is not properly created, thus throwing the error due to security reasons.
@pricey1981 Please contact your hosting provider for the live website and have them check the PHP session save path (session.save_path). It should be existing and writable.
makes a lot of sense. thanks!
does make me wonder tho.. why is this pointing to /tmp in the server root .. when this folder is not created?
@willem010 IIRC, that is the default session save path (set by PHP itself). The person configuring the server should make sure that the server environment is either able to use this folder, or change the configuration (PHP or server) in such a way that this is possible.
Some background info: http://stackoverflow.com/questions/4927850/location-for-session-files-in-apache-php (I need to read up on this as well haha)
ah, now that i know.. won't happen again. ;)
and for those who want to know.
looks like the avatar upload function is the cause of the gfm site hack.
session.save_path is set to /tmp and this folder exists and is writable. Unfortunately I'm still getting the same error
@pricey1981 Does this happen only on news items or also on other areas of your website (e.g. creating new pages)?
hey folks, take care when autocompleting @CaMer0n... :)
@willem010 Just to confirm. DId fixing the session save path solve your 'unauthorized access' errors? Did you remove the e_TOKEN_FREEZE line?
still need to remove it. i will test tomorrow.
@Moc happens when creating new pages too, and books/chapters
Just playing around again, when I added e_TOKEN_FREEZE to the config file the first time I tried to add a news item it worked. But not after. I've just removed that line from the config file and it allowed me to post a news item. But trying to delete that item, I get the unauthorized access error again. I add e_TOKEN_FREEZE back into the config file and can delete the news item
just in case this helps...
e107 CMS Log file : Unauthorized access Log 2015-11-26_07-44-23
-------------------------------------------------------------------------------------------
2015-11-26 07:44:23 debug HOST: www.uknetrunner.co.uk
REQUEST_URI: /e107_admin/newspost.php?mode=main&action=list
e-token (POST): ac4827f01a14e1cdbbfd8645f19cfaf3
_SESSION:
Array
(
[e107sess] => Array
(
[_session_validate_data] => Array
(
[RemoteAddr] =>
[HttpVia] =>
[HttpXForwardedFor] =>
[HttpUserAgent] => Mozilla/5.0 (Windows NT 10.0; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/46.0.2490.86 Safari/537.36
)
[language-list] =>
[challenge] => 82e5725ebbe40a097c4ba027251e7332e97797db
[prevprevchallenge] => 82e5725ebbe40a097c4ba027251e7332e97797db
[prevchallenge] => 82e5725ebbe40a097c4ba027251e7332e97797db
[ubrowser] => 785206e5cec747755d4c7ecee79ff9dc
[__form_token] => ff4b0932d74b89172c3a92000559ed625656b853d8e9e2.60404460
[_system_messages] => Array
(
[error] => Array
(
)
[warning] => Array
(
)
[success] => Array
(
)
[info] => Array
(
)
[debug] => Array
(
)
)
)
[_cookie_session_validate] => 1448545459
)
die = true
---------------------------------
2015-11-26 07:46:35 debug HOST: www.uknetrunner.co.uk
REQUEST_URI: /e107_admin/newspost.php?mode=main&action=list
e-token (POST): 8d924e19a59d11b30990f3b62e775f21
_SESSION:
Array
(
[e107sess] => Array
(
[_session_validate_data] => Array
(
[RemoteAddr] =>
[HttpVia] =>
[HttpXForwardedFor] =>
[HttpUserAgent] => Mozilla/5.0 (Windows NT 10.0; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/46.0.2490.86 Safari/537.36
)
[language-list] =>
[challenge] => 2a531485190a8cc55ac2f36c2370a44e482afb39
[prevprevchallenge] => 2a531485190a8cc55ac2f36c2370a44e482afb39
[prevchallenge] => 2a531485190a8cc55ac2f36c2370a44e482afb39
[ubrowser] => 785206e5cec747755d4c7ecee79ff9dc
[__form_token] => 5c0eb187ed05c30b56e178269ec90af45656b8d9333303.00179923
[_system_messages] => Array
(
[error] => Array
(
)
[warning] => Array
(
)
[success] => Array
(
)
[info] => Array
(
)
[debug] => Array
(
)
)
)
[_cookie_session_validate] => 1448545593
)
die = true
---------------------------------
@Moc a quick test and everything looks fine, we've created a page and newsitem with no problem.
we still need to check what happens when the admin takes a lot of time composing his item tho. (the siteadmin told me the issue usually appears when he takes a lot of time to enter and edit. a quick edit almost never had an issue?)
anyway the siteadmin will look out for more problems. when something comes up we will let you know.
@willem010 @pricey1981 Would you mind testing a change for me? Please enable debug of Paths + Variables. (ie. index.php?[debug=paths+] ) Under Session you should see some variables:
Session lifetime
Session domain
Session save method
Please share the values here. Thank you.
Session lifetime 86400 seconds Session domain .my-domain.nl Session save method files
domain is edited. i'm not posting my clients domain here. ;)
@CaMer0n I get the same as @willem010 (obviously my own domain, which is a .co.uk)
@CaMer0n how do I switch the debug off?
?[debug=all,unstick] ?[debug=all-]
Please update and try setting the session.save_path.
Option to define the session.save_path (relative to e107's root directory) in e107_config.php:
define('SESSION_SAVE_PATH','relative-path-to-folder');
example: define('SESSION_SAVE_PATH','../_sessions/');
Use the PHPInfo page in the admin area to check it has worked.
Will only work if the path to the folder exists.
If the "unauthorized access" is showing up after submitted a form (which has been open for over 24 minutes) - please try adding this to e107_config.php to see if it helps.
ini_set('session.gc_maxlifetime', 3600);
@CaMer0n appears to be working now. Thanks.
we will keep you posted. thnx!
@pricey1981 great! Which specific changes fixed it for you?
@CaMer0n just updating with the latest download from github. Although I still have the token_freeze comment in the config file - should I remove this?
@pricey1981 Yes please test when disabling the token freeze, by removing that line. It's useful to know if the issue then returns.
Have removed the token freeze and can add news items ok, but can't delete.
hmmm, maybe that was becasue I pressed the back button rather than re-loading the page. Items deleted ok now.
Still getting "unauthorized access" when undertaking other admin tasks, such as updating user settings
@pricey1981 Did you try the ini_set('session.gc_maxlifetime', 3600);
in your e107_config.php file as suggested by Cameron?
I'm not sure how much server configuration knowledge you have but on the live website, you'll need to take into account that the /tmp folder is not the one in public_html (or wwwroot). You'll need to contact your hosting provider in order to have them verify the session save path.
@Moc , sorry, only just seen your post. No, I didn't not try Cameron's suggestion as I am getting the error when the form has been open for only a very short period of time, e.g. less than one minute.
As I said above session.save_path is set to /tmp, which is in the non-public root, and this folder exists and is writable.
i just ran into this issue again where i got unauthorized acces when trying to edit an (very old) news item. as soon as i tried to save an edit i was thrown out with unaut. acces i was unable to save the item in any way.
the body text had an old image in there which didn't exist at that url, and i was trying to get that edited but i wasnt allowed. any changes to this news item threw an error. not just a change to the url. in most cases i needed to login again to gain acces to the admin section again.
but .. after getting tired of being thrown out, i decided to edit the image directly in the database, as soon as i did this, i was allowed to edit the item using the admin section again. so .. it looks like an image which isnt working (in the main body text of a news item) is creating an issue here.
btw, the admin logs shows lines pretty much the same as what @pricey1981 posted, but does mention the tinymcse parser as prevous url. thats why i entered this here. (but there is another issue i think is pretty much the same.)
Thank you @willem010 - this is a good clue!
@CaMer0n any further progress on this?
As a test, I have set up a fresh install of e107 in a subdirectory of my live site. I appear not to receive any errors with this install which leads me to believe it is not server based. My live site was an upgrade from e107 v1. I'm assuming therefore, on the presumption that the v2 files have overwritten v1, that this is something to do with the DB? Or, might it be possible that there is a legacy v1 file causing a conflict?
I've manually replaced the contents of SitePrefs in the e107_core table of my live site with the data from the newly installed dummy site. I no longer get the unauthorized access error. I will now setup the site preferences again to see if this resolves the issue. It seems it might be to do with some legact settings in this table/record
@pricey1981 Thank you!
@pricey1981 https://gitter.im/e107inc/e107# in case you wish to discuss it.
Trying to post a news item but getting a blank white page which simply says "unauthorized access". Works fine on WAMP server but not on live site. I am setup as main admin so can't be permissions? Also another admin with correct permission having same issue.
Any ideas?