8
This probably isn't the answer your looking for, but your mention of Singapore and then reading the conversation thread at Ellis Lab, my first thought was you're hitting some internet restriction, either by the ISP, but more likely by the country.
In Singapore the government via the Media Development Authority (MDA) bans, blocks, and otherwise monitors ...
6
I discovered the problem. We were using CartThrob's fingerprinting for sessions with the configuration set to "0" for the default fingerprinting method. The default method creates the fingerprint as:
$fingerprint = $this->EE->input->server('HTTP_ACCEPT_LANGUAGE').$this->EE->input->server('HTTP_ACCEPT_CHARSET').$this->EE->input->...
5
Change the Control Panel Session Type to "Cookies only".
Control Panel Location: Admin ‣ Security and Privacy ‣ Security and Sessions
Only cookies are used to track the admin user. When this setting is
used a “remember me” checkbox will appear next to the Control Panel
login page, enabling users to stay permanently logged in.
4
ExpressionEngine natively processes forms in secure mode which means each for submission is tied to an automatically generated XID / Hash which is passed as a hidden field in all CP and most front-end forms.
The XID is a hash containing a reference to a database entry which gives EE a bunch of info about the user (their user agent, timestamp created, ip ...
3
After a few weeks of attempting to track down this bug, we finally found the culprit was misconfigured cookie_domain setting.
In our config file, we dynamically set the cookie domain so cookies work with our various MSM sites:
$config['cookie_domain'] = '.' . preg_replace('#^www\.(.+\.)#i', '$1', $_SERVER['HTTP_HOST']);
During our server switch,...
3
You can query the exp_sessions table, where you can see both the ip_address and member_id for each session. Multiple sessions from wildly different IPs would be a cue that an account was being shared widely.
3
This is an old bug that caused a lot people problems. You can read the lengthy bug report here: https://support.ellislab.com/bugs/detail/17423
Bottom line: you'll need to update to the latest version of EE
3
The answer to this lay in the Varnish configuration. Basically, in the vcl_recv function, I created my logic for whether to "lookup" (check the cache, fetch from the backend if the cache is empty), or "pass" (always serve from the backend).
Then in vcl_pass, I added an HTTP header to the request indicating "this request was passed and should never be cached"...
3
It is possible, but the mechanism for generating session IDs changed for EE 2.6, so if you want to retain compatibility with 2.5 and under (as I did) you need to add in a quick version_compare check.
Here's the snippet that I'm using with Missing Link.
$sess_type = $this->EE->config->item('admin_session_type');
$session_id = ($sess_type == 'c') ? '...
3
Use Stash - Here's how:
{!-- ============================================
STORE A LIST OF RELATED ARTICLES INTO A LIST
================================================== --}
{!-- first the manually chosen ones --}
{exp:stash:set_list name="rels" parse_tags="yes" trim="yes"}
{exp:channel:entries channel="article"}
{related_articles}
...
3
Yes, it's possible (assuming you're talking about triggering the ExpressionEngine status message in the control panel, not generically setting flash data from an AJAX request).
I had this same question a few days ago - I know for example the CP template manager triggers the success message at the top of the page from an AJAX request, so I went trawling ...
2
Like MJR suggest, set a javascript timer to about the same length as the logout / session-expiration timer. Then redirect after timeout.
The elegant part: Around 20 or 30 secs before expiration, popup a dialog that the session is about to expire.
(maybe redirect to a page where the user is going to be logged out, to prevent redirecting without the session ...
2
Really good question. I suppose it could open you up to session sidejacking.
There's a couple of potential solutions I can think of without doing any research or prototyping.
If the website is managed by a business, you could make your HTACCESS file only allow access to the control panel for certain IP addresses (yours and their offices). Alongside this, ...
2
The main suggestion I have is setting a value for the cookie prefix and seeing if that works.
I actually had a similar problem to this on ONE site that was configured seemingly identically to some of my others, but this exact thing happened to me. This set of config items added to my main config.php seemed to alleviate it for me:
$config['cookie_domain'] = ...
2
EE 2.4, in libraries/Template.php on line 2929 we have
if (isset($this->EE->session->userdata[$val]) AND ($val == 'group_description' OR strval($this->EE->session->userdata[$val]) != ''))
line 226 in your code, try to add "0,":
$EE_login->session->userdata['screen_name'] = $query->row(0,'screen_name');
$EE_login-...
2
You can use the {cp_session_id} global variable to create a control panel link. See the documentation here.
{if logged_in_group_id == "1"}
<a href="{cp_url}?S={cp_session_id}">go to admin</a>
{/if}
2
Remember Me
Save entries for a user during a session. This could be used for a
'add to cart' function or for a 'product compare' function (save
entry_id's for later use). Entries are only stored during a session.
As of version 1.0 you can also save the session storage to the
database on a per member basis.
Session Variables Plugin
Sometimes ...
2
Well the short answer is you can'tshouldn't easily, it raises all sorts of questions regarding the security model!
However there may be alternatives. You could for instance write an extension for EE that exposes an ACTion (as Derek said), or more simply just write a template, and then get your information through AJAX/curl from your other external page.
...
2
The "Fingerprint field" is missing in DB.
Go to Database to trigger this query.
ALTER TABLE `exp_sessions` ADD `fingerprint` VARCHAR( 40 ) CHARACTER SET utf8 COLLATE utf8_general_ci NOT NULL AFTER `user_agent`
2
To be able to do this at all EE would need to know information about past browsing behaviour of your visitors. This in turn would require you to either record information about the visit in the EE database (e.g. IP address / dates) or plant information on the visitors devices via cookies or some such. Both of these actions would be covered by GDPR and so ...
1
If there is no session, then there is no logged in user. All of the user login code runs after the sessions_start hook.
1
I believe what changed is that EE now defaults to requiring session IDs in the control panel URLs. (That's the S=e8a181fc77af1b35e47193c0e0b27a15 part you see.)
You can disable this at Admin -> Security and Privacy -> Security and Sessions, changing the Control Panel session type to Cookies Only.
Or, you can just add the session ID into your URLs, which is ...
1
For some reason, expressionengine/controllers/ee.php hadn't been replaced during the update, so instead of:
class EE extends EE_Controller {
it was
class EE extends CI_Controller {
1
Have you tried clearing the cache (Tools > Data > Clear Caching)?
If that doesn't help - what add-ons are you using? If you try disabling them one by one, does that fix it?
1
I seem to recall freeform processes the form before returning you to the return page, loosing post data. You can specify %%entry_id%% in the return param and use that to do a look up of the entry and set a cookie or some such.
I've done something similar but used stash to store session vars. Its not perfect but achieves a similar outcome.
1
What about setting a cookie with a random string as the identifier? Will be much more reliable I think.
Just create the string once, then set the cookie and insert your visitor into your database at the same time.
if( ! $cookie = ee()->input->cookie('guest_id') )
{
ee()->load->helper('string');
$id = random_string('unique');
ee()-&...
1
You can use addon Stay Up Forever for this purpose.
1
My approach would be to use Stash.
On the checkout page:
{exp:stash:set_value
name="checking_out" {!-- User is checking out --}
value="1" {!-- Store any value --}
scope="user" {!-- Limit this to the user's session --}
save="yes" {!-- Store in the database --}
refresh="10" {!-- Only valid for 10 minutes --...
1
member_member_login_start is what you're looking for
1
Just found a way to avoid this problem
I change the hook from cp_js_end to the cp_menu_array hook.
Will work
function cp_menu_array($menu)
{
print_r(ee()->session)
}
Please make sure that you not returning your JS but add your js with to the with ee()->cp->add_to_foot('<script type="text/javascript"></script>');
Only top voted, non community-wiki answers of a minimum length are eligible
