3

I just upgraded one of my sites from EE 2.5.2 to 2.7.3 and everything seemed to go fine, but now on the front end when a user attempts to log out they get this error:

**The following errors were encountered**

You are not authorized to perform this action
Return to Previous Page

Anyone know why this is or how to fix it?

  • Based on @Max Lazar's comment I was looking over our "logout" code vs. the code given in EE's documentation and I noticed this difference, we use this code: <a class="icon-unlocked" href="{path='?ACT=10'}">Log Out</a>, but the docs say to use {path='logout'}. Does it matter? – Adam Christianson Jan 30 '14 at 16:50
  • go to CP -> tools -> data -> sql manager and check in exp_actions table what exactly '?ACT=10' is. Possible some third-party module. For native logout it must be class = Member, method = member_logout. – Max Lazar Jan 30 '14 at 16:59
  • That's the odd thing. ?ACT=10 is the Member member_logout function. Could it be something to do with the session settings? We have both the CP and the Users sessions set to Cookie Only. The thing is that logging out from the CP does work fine. – Adam Christianson Jan 30 '14 at 18:14
  • do you have any ext. which use member_member_logout hook (can be check in exp_extensions table)? Like Login Redirect? btw what happend after "Return to Previous Page"? User still login? – Max Lazar Jan 30 '14 at 19:16
  • There is an old extension, Foxee, but it is disabled. We uninstalled and removed it long ago, but it still has entries in the exp_extensions table. Would it cause the problem been thought it's not marked as enabled? – Adam Christianson Jan 31 '14 at 5:08
7

Based on @Max Lazar's comment I was looking over our "logout" code vs. the code given in EE's documentation and I noticed this difference, we use this code: Log Out, but the docs say to use {path='logout'}. Does it matter?

I solved the mystery. The question I made above ^^^ was key and I probably should have just tried it from the get go. Turns out it was the answer. While the ACT=10 is the right action for logout in my install the problem is that the URL generated doesn't include the XID value which EE 2.7 now requires.

So you MUST use the EE tag {path='logout'} to generate logout URLs and link because it will also add an XID={hash} so that the logout submission is authorized.

UPDATE I discovered that you could also add the XID value to your path by using the {XID_HASH} global tag. So in addition to changing my logout link to use {path='logout'} I believe I could have also done:

<a href="{path='?ACT=10'}&XID={XID_HASH}">Log Out</a>
| improve this answer | |
2

Check and update all your add-ons first. One of the difference between 2.5.2 & 2.7.3 is that now XID hash code is mandatory for all forms. Many add-ons don't used it before, as result - You are not authorized to perform this action after EE update. For member_logout function XID is also mandatory.

$xid = ee()->input->get('XID') ? ee()->input->get('XID') : '';
    if ( ! ee()->security->secure_forms_check($xid))
    {
        return ee()->output->show_user_error('general', array(lang('not_authorized')));
    }

Possible you use something like FreeMember.

| improve this answer | |
  • I updated all my add-ons before upgrading, so everything I'm using is up to date. I do have Social Login Pro installed, so I will look at that, but the main login form is the standard one. – Adam Christianson Jan 30 '14 at 15:48

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.