Getting logged out constantly...

[weaver]

I'm pretty stumped by this one: I'm constantly getting logged out.

For instance, I log in, click on "clients", and am logged out, with the message: "No user account ID was found in sessions. Please log in again below."

If I click on "modules" same thing. Randomly adding a form, same thing.

The next bit of strangeness: When I log in, sometimes it takes five or six tries before it works.

Very strange. Anyone seen this before?

Platform Type
Debian
MySQL Version
5.0.45
PHP Version
5.2.5

[Ben]

Hi Weaver,

Yes, I've encountered this a few times, but the inconsistent nature of the problem IS rather odd! Here's a couple of possible causes:

1. Are you running Suhosin - the hardended PHP project? (check your phpinfo() and do a search fo suhosin). That can limit the amount of information you can store in sessions, which can cause Form Tools to think that you're not actually logged in, and boot you out.

2. You accidentally changed the "sessions timeout" user account setting to something really low. I've done this in the past and it took me an embarrassing amount of debugging to realize that I had the brain the size of a walnut.

But in terms of a solution... try switching to use database sessions. Worth a shot. Just add this line to your config.php file:

PHP Code:

<?php 

$g_session_type = "database"; 

[weaver]

Suhosin doesn't show in phpinfo().

The "sessions timeout" was set at 5, I've since tried changing it to 999 to no effect.

Added php line my global/config.php file, and got a blank admin screen. Is there more to setup for this to work?

Oddly enough, I created a client login, and that doesn't seem to have any problems. (It has a pretty drastically reduced set of menu options though...they can only view the form[/align].)

[Ben]

Yeah, this definitely sounds like a sessions problem. When client accounts log in, they have less information stored in sessions (less info to see & far less complex!). It looks like there's a limit to the amount of info that can be stored in sessions. There may well be something else installed besides suhosin that's doing this.

If you like, send me a PM with a link to your phpinfo() and I'll give it a look over!

w.r.t. the database sessions, no - it should work without any further configuration. Who's your hosting provider, by the way? It's not iPowerWeb is it?

- Ben

[weaver]

Got distracted, but am now back to debugging this issue, here's what I found. In your session_start.php file, it's written as:

Code:

if ($g_session_type == "database")
  $sess = new SessionManager();

if (!empty($g_session_save_path))
    session_save_path($g_session_save_path);

session_start();
header("Cache-control: private");
header("Content-Type: text/html; charset=utf-8");

$folder = dirname(__FILE__);

require_once("$folder/library.php");

As written, the config.php file is never loaded until AFTER the session has already been created. Hence, adding the line you mentioned to my config.php didn't actually switch it to database sessions.

By re-ordering things like this:

Code:

$folder = dirname(__FILE__);
require_once("$folder/library.php");

if ($g_session_type == "database")
    $sess = new SessionManager();

if (!empty($g_session_save_path))
    session_save_path($g_session_save_path);

session_start();
header("Cache-control: private");
header("Content-Type: text/html; charset=utf-8");

...I'm ensured that the config.php file is read, and my setting is used. Database sessions seem to now work correctly, and I am no longer logged out at random.

At this point I just wanted to run this solution past you to check if you can see any potential problems with this re-arrangement.

[Ben]

Weird. I change this a long while back; I'm going to have to look it over to figure out why it's organized with the require_once at the bottom.

No, that shouldn't cause any problems at all! If I find out something about why I ordered it that way I'll let you know. The only problem will be with upgrading: that file will be overwritten.

- Ben