6
I discovered the problem. We were using CartThrob's fingerprinting for sessions with the configuration set to "0" for the default fingerprinting method. The default method creates the fingerprint as:
$fingerprint = $this->EE->input->server('HTTP_ACCEPT_LANGUAGE').$this->EE->input->server('HTTP_ACCEPT_CHARSET').$this->EE->input->...
5
Change the Control Panel Session Type to "Cookies only".
Control Panel Location: Admin ‣ Security and Privacy ‣ Security and Sessions
Only cookies are used to track the admin user. When this setting is
used a “remember me” checkbox will appear next to the Control Panel
login page, enabling users to stay permanently logged in.
4
ExpressionEngine natively processes forms in secure mode which means each for submission is tied to an automatically generated XID / Hash which is passed as a hidden field in all CP and most front-end forms.
The XID is a hash containing a reference to a database entry which gives EE a bunch of info about the user (their user agent, timestamp created, ip ...
3
It is possible, but the mechanism for generating session IDs changed for EE 2.6, so if you want to retain compatibility with 2.5 and under (as I did) you need to add in a quick version_compare check.
Here's the snippet that I'm using with Missing Link.
$sess_type = $this->EE->config->item('admin_session_type');
$session_id = ($sess_type == 'c') ? '...
3
The answer to this lay in the Varnish configuration. Basically, in the vcl_recv function, I created my logic for whether to "lookup" (check the cache, fetch from the backend if the cache is empty), or "pass" (always serve from the backend).
Then in vcl_pass, I added an HTTP header to the request indicating "this request was passed and should never be cached"...
3
Use Stash - Here's how:
{!-- ============================================
STORE A LIST OF RELATED ARTICLES INTO A LIST
================================================== --}
{!-- first the manually chosen ones --}
{exp:stash:set_list name="rels" parse_tags="yes" trim="yes"}
{exp:channel:entries channel="article"}
{related_articles}
...
3
After a few weeks of attempting to track down this bug, we finally found the culprit was misconfigured cookie_domain setting.
In our config file, we dynamically set the cookie domain so cookies work with our various MSM sites:
$config['cookie_domain'] = '.' . preg_replace('#^www\.(.+\.)#i', '$1', $_SERVER['HTTP_HOST']);
During our server switch,...
3
You can query the exp_sessions table, where you can see both the ip_address and member_id for each session. Multiple sessions from wildly different IPs would be a cue that an account was being shared widely.
3
This is an old bug that caused a lot people problems. You can read the lengthy bug report here: https://support.ellislab.com/bugs/detail/17423
Bottom line: you'll need to update to the latest version of EE
2
You can use the {cp_session_id} global variable to create a control panel link. See the documentation here.
{if logged_in_group_id == "1"}
<a href="{cp_url}?S={cp_session_id}">go to admin</a>
{/if}
2
EE 2.4, in libraries/Template.php on line 2929 we have
if (isset($this->EE->session->userdata[$val]) AND ($val == 'group_description' OR strval($this->EE->session->userdata[$val]) != ''))
line 226 in your code, try to add "0,":
$EE_login->session->userdata['screen_name'] = $query->row(0,'screen_name');
$EE_login-...
2
Well the short answer is you can'tshouldn't easily, it raises all sorts of questions regarding the security model!
However there may be alternatives. You could for instance write an extension for EE that exposes an ACTion (as Derek said), or more simply just write a template, and then get your information through AJAX/curl from your other external page.
...
2
Remember Me
Save entries for a user during a session. This could be used for a
'add to cart' function or for a 'product compare' function (save
entry_id's for later use). Entries are only stored during a session.
As of version 1.0 you can also save the session storage to the
database on a per member basis.
Session Variables Plugin
Sometimes ...
2
The "Fingerprint field" is missing in DB.
Go to Database to trigger this query.
ALTER TABLE `exp_sessions` ADD `fingerprint` VARCHAR( 40 ) CHARACTER SET utf8 COLLATE utf8_general_ci NOT NULL AFTER `user_agent`
2
To be able to do this at all EE would need to know information about past browsing behaviour of your visitors. This in turn would require you to either record information about the visit in the EE database (e.g. IP address / dates) or plant information on the visitors devices via cookies or some such. Both of these actions would be covered by GDPR and so ...
1
First initial thought is: can you use sessions_end hook instead?
Looking at the Session.php code for where the session_start is fired, this hook kicks in before the user data is set from the cookie/session as the next lines that come after the hook are:
// Set the validation type
$this->validation = (REQ == 'CP') ? ee()->config->item('...
1
Control Panel Logs is existed not just to show logged users but logged all critical activities(not only login) in CP. EE keeps this records in _cp_log table.
For front-end is not such functions from the box.
But you can try module called Audit Pro
Audit tracks:
Member Logins, including Control Panel & front-end
Member Logouts, including Control Panel &...
1
You can try Stay Up Forever
It call "Forever", but based on code you can setup any session timeout in extension settings (for cpanel or/and user)
1
Pop open your config file: /system/expressionengine/config/config.php
Look for a config option for 'permitted_uri_characters' - if you don't have it, you can add the line:
$config['permitted_uri_chars'] = "a-z 0-9~%.:_\-";
This is what I use (and I think it's the default). But you should be able to just remove the period.
If you use Structure (or ...
1
Yes this is the right way. Performance will be the same, or similar, as if you had the same amount of traffic going through one website.
To be cautious you could try scaling up to the full 20 websites a few at a time. Check performance and if it's OK then add a few more.
You may also want to talk to Ellis Labs to see if you could switch your MSM licences ...
1
Have you tried outputting the session > userdata > fingerprint on the template. I've used this in addons to recreate the session ID in the control panel.
ee()->session->userdata['fingerprint']
I haven't accessed or tried this on a template though, but it might point you a the right direction.
1
This my be useful to you, it describes how to use cURL with session cookies
https://stackoverflow.com/questions/13020404/keeping-session-alive-with-curl-and-php
1
So far as I'm aware you will need to do something special, Max alluded to being able to set a cookie. Without doing so your cURL request is seen as a totally separate session since it's initiated by your server, not by your browser.
1
If there is no session, then there is no logged in user. All of the user login code runs after the sessions_start hook.
1
I believe what changed is that EE now defaults to requiring session IDs in the control panel URLs. (That's the S=e8a181fc77af1b35e47193c0e0b27a15 part you see.)
You can disable this at Admin -> Security and Privacy -> Security and Sessions, changing the Control Panel session type to Cookies Only.
Or, you can just add the session ID into your URLs, which is ...
1
For some reason, expressionengine/controllers/ee.php hadn't been replaced during the update, so instead of:
class EE extends EE_Controller {
it was
class EE extends CI_Controller {
1
Have you tried clearing the cache (Tools > Data > Clear Caching)?
If that doesn't help - what add-ons are you using? If you try disabling them one by one, does that fix it?
1
I seem to recall freeform processes the form before returning you to the return page, loosing post data. You can specify %%entry_id%% in the return param and use that to do a look up of the entry and set a cookie or some such.
I've done something similar but used stash to store session vars. Its not perfect but achieves a similar outcome.
1
What about setting a cookie with a random string as the identifier? Will be much more reliable I think.
Just create the string once, then set the cookie and insert your visitor into your database at the same time.
if( ! $cookie = ee()->input->cookie('guest_id') )
{
ee()->load->helper('string');
$id = random_string('unique');
ee()-&...
1
You can use addon Stay Up Forever for this purpose.
Only top voted, non community-wiki answers of a minimum length are eligible
