A few users have said they receive " access denied" messages when logging into my website.
I have yet to be able to identify the cause if this, im currently going through with a test user unloading plugins to see if its caused by these or not.
I cant seem to be able to locate the thread that assist with tracking down these access denied messages, my security level is set to [5] Balanced.
a couple of questions - can I edit the " Access Denied" message to include my email address so I can actually get a guage for how many people are affected, or if there is anything in common?
This does not happen for all my users, and when I was provided with the password for a user that was receiving the message, i was able to log in fine, and then the user could also log in fine after....? seems very strange and something i cannot track down...
is there anything I can do? I've enabled developer mode, and not seen anything odd ?
I have some jquery being delivered in a shortcode that pops up a notification etc... and also in the featurebox.... would I need to include define('e_TOKEN_FREEZE', true); in these too?
To prevent loads of useless frustration, please check this common error related to session files: [-link-]
Lets check those first, otherwise we might just be wasting time. As soon as we've ruled out the above two we'll continue to debug but I strongly recommend to check both javascript/ajax calls and the session files before checking anything else.
Directive Local Value Master Value session.auto_start Off Off session.bug_compat_42 On On session.bug_compat_warn On On session.cache_expire 180 180 session.cache_limiter nocache nocache session.cookie_domain no value no value session.cookie_httponly Off Off session.cookie_lifetime 0 0 session.cookie_path / / session.cookie_secure Off Off session.entropy_file no value no value session.entropy_length 0 0 session.gc_divisor 100 100 session.gc_maxlifetime 1440 1440 session.gc_probability 1 1 session.hash_bits_per_character 4 4 session.hash_function 0 0 session.name SESSVR6OC PHPSESSID session.referer_check no value no value session.save_handler files files session.save_path /tmp /tmp session.serialize_handler php php session.use_cookies On On session.use_only_cookies On Off session.use_trans_sid 0 0
Checked the plugin list and I'm not running of those plugins...
global $tp, $sql;
parse_str($parm);
$pm_file1 = e_PLUGIN."pm/pm_func.php";
include_once(is_readable($pm_file1) ? $pm_file1 : e_PLUGIN."pm/pm_func.php");
$pm_inbox = pm_getInfo("inbox"); // This will retrieve the pm_info array from pm_getInfo function
$new = intval($pm_inbox['inbox']['unread']); // new messages are passed in the array with 'new', not with 'unread'
if ( $new > 0 )
{
$messageSpam = $new." ".($new == 1 ? "New message" : "New messages");
}
if (USER)
{
if ($new > 0)
{
$ret = "
<script language='JavaScript'>
jQuery(document).ready(function()
{
jQuery.sticky('<a href=".e_PLUGIN_ABS."pm/pm.php?inbox><b>You have $messageSpam</b></a>');
});
</script>
<div class='topnav'>
<a href='".e_PLUGIN_ABS."pm/pm.php?inbox'>$messageSpam</a>
<a href='".e_BASE."usersettings.php'>".X_THEME_16."</a>
<a href='".e_BASE."user.php?id.".USERID."'>".X_THEME_17."</a>
<a href='".e_BASE."index.php?logout'>".X_THEME_18."</a>
</div>";
}
else
{
$ret = "
<div class='topnav'>
<a href='".e_PLUGIN_ABS."pm/pm.php?inbox'>Your messages</a>
<a href='".e_BASE."usersettings.php'>".X_THEME_16."</a>
<a href='".e_BASE."user.php?id.".USERID."'>".X_THEME_17."</a>
<a href='".e_BASE."index.php?logout'>".X_THEME_18."</a>
</div>";
}
}
else
{
$ret = "
<div class='topnav'>
<a href='".e_BASE."signup.php'>".X_THEME_9."</a>
<a href='".e_BASE."login.php'>".X_THEME_10."</a>
</div>";
}
if (ADMIN)
{
$ret .= "
<div class='topnav'>
<a href='".e_ADMIN."admin.php'>".X_THEME_19."</a>
</div>";
}
if (!USER && defined("LOGINMESSAGE") && LOGINMESSAGE != "")
{
$ret = "
<div class='topnav'>
".X_THEME_20." <a href='".e_BASE."login.php'>".X_THEME_21."</a>
".X_THEME_22." <a href='".e_BASE."fpw.php'>".X_THEME_23."</a>
</div>";
}
return $ret;
Would I need the e token freeze thing in the above and if so - where?
I'm not an experienced coder in e107 so I don't know, I'll leave that to someone else. Now, use the debugger to find those errors about session in the wiki. [-link-] If you don't get those error messages, you're fine. My best bet would be the etoken freeze or plugin incompatibility.
Ok you should be fine then I would say a plugin/code mod is causing the problems, though I'm not an expert in javascript and I am not able to give clear advice on how to implement the etoken freeze option in your scripts. Hopefully someone else with more knowledge about this will comment on it
I just don't understand why it randomly only happens to some users? I log in multiple times every day from various browsers and all seems to be fine... Just don't seem to be able to pinpoint the trigger...
This user simply requested a password reset, received the email, e107 generated new password, and when the user then tries logging in they get access denied message on all subsequent attempts to log in, regardless of closing the window and re-opening etc...
As I can't reproduce the issue, I can't try the debugging with the live http headers as per the wiki and my users are not skilled enough to do it for me...
Nothing to do with the login issues but if you are still using SLIR and the default e_meta we provide, you are double loading Jquery from the looks of the code you posted.
what would be nice is if the " Access denied" message was more useful to the user that they could submit to the webmaster, I.E what has caused the e_token regeneration etc...
The message " Access denied" comes from class2.php You'll find it on line 197 and 504. Change both, like die('+++ Access denied: line 197'); and die('--- Access denied: line 504');
This way, you could ask: what was the number? Knowing this,you (we) will know more about when they are happening.
Better yet, replace the simple ' Access denied' message with a more sophisticated log to file (or database) - as can be seen on lines 492-499.
Hi mate. Would you be able to create a debug version of class2.php please ? Not entirely sure how I could inplement some useful feedback that would allow me to identify where the regeneration came from..
I had this problem for almost a year and no one was able to help. On my site did not work the password recovery option that causes fpw.php file. The problem was in the e_TOKEN that is not properly assigned or read for some e107 templates !!!!. My template is custom and comes from a very old version of e107. Access Denied disappeared since swapped e107_themes/templates/fpw_template.php file from an earlier version of the script. Perhaps the same can be done with turning admin_template.php admin area. On this moment the problem is FIXED for me