Hi Friends,
I was having trouble with this error message in a different forum which uses Simple Portal. I posted about it in the SMF forum here: https://www.simplemachines.org/community/index.php?topic=560898.0
Based on what I learned there, it gives me the idea that the reason I'm now seeing in my forum which runs TP, the problem might be with TP - specifically the login block. I am running TP version 1.5.1, which the last time I looked is the current version (unless there's been a new release in the last couple of months).
I really didn't start seeing this error in this forum until after I upgraded TP. I saw it once or twice before, but after upgrading, it got to be...well, maybe I would not call it a flood, maybe just a river. I have about 4 pages of this error over the last month.
Here's all your info:
Link to my forum: https://forum.inkscapecommunity.com/index.php
SMF version: 2.0.15
TP version: 1.5.1
Default Forum Language: English
Theme name and version: Aqua Style 2.0
Browser Name and Version: Sea Monkey, Firefox, IE (can scrounge up version #s if really needed
Mods installed: approx 40, can post a list if needed
Related Error messages: see below
https://forum.inkscapecommunity.com/index.php?action=login2
Unable to verify referring url. Please go back and try again.
I can't think of any more relevant info, but just ask if you need more.
Is there anything I can do to fix this, besides just disabling that block?
Thank you very much :)
Brynn. Thought you'd cured this one some time back. Are you sure it's the TP user block that's causing it? Does the error go away if you disable that block, like I suggested before. We haven't had any such problems.
Also I see you have a few themes on there, have you added the login fix to all those themes? You will need to if they have a login form.
I thought we fixed it too!
No, I'm not sure it's coming from that block. I just assumed, based on that other investigation (where we did confirm it by disabling that block). I didn't think you could get the same error from a different thing. But I'll try temporarily disabling that block.
When we finished that other topic before, about the non-TP forum, all signs indicated the problem was solved. I watched it for a week and didn't see the error. But when I look at it now, I do see that error again. Not nearly as much as before though.
Regarding the other themes, I thought the login fix was to upgrade the portal mod. I upgraded both forums. Wouldn't upgrading the mod fix it for all the themes?
I've just counted 9 people using non-default themes in the TP-using forum. But we only have maybe 4 or 5 members who visit regularly. I'd have to do a little research to find out if it's those members hitting this error.
Regarding disabling the login block - my default theme has another login block in the top-right corner of the page. I don't think that can be disabled. Is there any other way to know where the error is coming from?
Thanks again.
Is that a custom block or part of the standard tp blocks? I can't remember seeing it... if it's custom can you post the contents here in code tags please.
Also can you confirm if you're running Arantors login fix mod.
The login from the Tinyportal User block was fixed when SMF 2.0.14 came out. That caused a problem when you had that block showing regardless of fixing the theme. SP had the same problem, and you experienced that on you other site. Turning off that block should stop the error completely for diagnosis. If you turn it off and still get the error then it's coming from somewhere else.
So basically SMF 2.0.14+ now requires the a session check in the <form> for the login function, be it a custom theme or mod which has a login form will need the session check added to it.
As far as I'm aware Arantors login fix mod should have that covered if you have it installed on both sites. Maybe it doesn't cover every scenario, I'm not sure.
Still a good idea to go through any themes served to your members to make sure the session check is in place.
Pretty sure that if it was coming from the portal we'd know about it by now, and it would show up when any of us test it, or use it. As you know I'm a member on your site, I've logged in and out on your site yesterday using this block and no errors at all.
tino, the login fix for the user block was added here, by myself in Jun 19, 2017
https://github.com/Tinyportal/TinyPortal/commit/fde9a7f67fcdb06b93642f3a00dbb392fe1e2b9e#diff-801457335636df0145ee7b9e716d41c0
As far as I'm aware it hasn't caused any issues since. Or at least no one else has reported any login issues.
as far as I can see it: the Tinyportal login block is working or not. It cannot be working 'most of the time', so I would look into other potential causes..
Are you sure its not just someone has bookmarked that url?
https://forum.inkscapecommunity.com/index.php?action=login2
If I click it, then I get the error as expected.
What are the IP's associated with the error log entry?
Quote from: @rjen on November 11, 2018, 11:50:47 AM
as far as I can see it: the Tinyportal login block is working or not. It cannot be working 'most of the time', so I would look into other potential causes..
I agree, it's there or it's not. Intermittent problem, seems more like some random server issue to me. Especially as the issue is still on Brynn's other site which runs SP.
Quote from: tino on November 11, 2018, 12:08:26 PM
Are you sure its not just someone has bookmarked that url?
https://forum.inkscapecommunity.com/index.php?action=login2
If I click it, then I get the error as expected.
What are the IP's associated with the error log entry?
Wondering about that myself. Brynn has posted that link in post here and over at SMF so people will click it. I get the error as well if I'm not logged in over there and click it.
Just like on Brynn's other site, same thing.
Wow, thanks for all the discussion. I can't follow all of it, but I think I got most of it.
I don't think I have ever installed Arantor's login fix mod. Maybe I misunderstood from the old SMF topic, but I thought upgrading would fix it, and I wouldn't need the mod fix. Do I need both the current portal mod version and the login fix mod?
Oh, I have Arantor's CAPTCHA mod! But no, I don't see anything like a login fix mod in Package Manager.
I guess I'm still unclear about themes. If I'm running the current portal version, do I still need to do somthing about the themes?
I guess I could search the member list for those IPs. Then if they are members, I can find out which theme they're using. Right? I can find out what theme they're using by looking at their profile settings, right?
Is the current question, who is hitting the error, and are they just clicking where I posted the error message in the old topic?
Let's see....
Except for lurkalot, everyone who hits that error is a Guest. I have no way of knowing if they are a member who is legitimately trying to log in.
I saw one IP that hit it something like 15 to 20 times (different days, over a week or 2, but when it's on the same day, a minute or few seconds apart - that one seems sadly like someone who wants desperately to log in). Most IPs are just hitting it 1 to 4 times.
Do you want me to actually list some of the IPs?
If I pay very, very close attention, I might be able to catch an error happen, and use my analytics to see where they came from. Oooh, my analytics.... I don't see any evidence of people coming into my site from SMF. Although not everyone allows themselves to be tracked. Apparently lurkalot does not ;D
Ok I'm going to disable that block now. I'll watch the error log and see what happens.
Thanks for your comments and attention :)
Brynn the portal is already fixed in the version you are using, so the error is coming from somewhere else. Anything that has a login form will need the fix applied if its not already there. That means themes other mods anything that has a login form.
That basically means any theme built before SMF 2.0.14 was released. Not sure if you have a copy of Arantors mod to try, if you have then give it a go. If you haven't, then I think you're out of luck because he removed all his mods I think. So you'd have to check and do them manually. https://wiki.simplemachines.org/smf/Login_error_2.0.14
Wonder if you're having a similar problem to this one, https://www.simplemachines.org/community/index.php?topic=562154.0
Ok yep, I've had 2 hits on that error since disabling the block.
I use the mod which interfaces with SFS (I always forget exactly which one it is - StopSpammer or Bad Behavior), so if anyone - any of these IPs which are hitting the error are in the SFS DBs, and tried to register, they couldn't. And they theoretically could be trying repeatedly to log in.
But to me, that begs the question. If someone is not a member, i.e. a Guest, why would it create an error (for me) and error message (for them). They're essentially just any random person on the internet. Why should that produce an SMF error?
I mean, wouldn't it be more logical for them to see a message saying 'you must register before you can log in' rather than produce an error about the referring url? Shouldn't SMF check to see if they are a member before it spits an error?
And especially if it were bots. There must be bazillions of bots surfing around the internet. Why should they trip an error for SMF if they try and fail to log in?
There must be something I don't understand about the message you referenced.
QuoteThat means themes other mods anything that has a login form.
How can I find out if a theme has a login form? I thought the themes use the same login form as the default, but it just looks different, to match the theme?
Thanks :)
Oh, do you mean exactly like that one in the top-right corner of my default theme?
Quote from: brynn on November 13, 2018, 05:16:43 PM
Ok yep, I've had 2 hits on that error since disabling the block.
I use the mod which interfaces with SFS (I always forget exactly which one it is - StopSpammer or Bad Behavior), so if anyone - any of these IPs which are hitting the error are in the SFS DBs, and tried to register, they couldn't. And they theoretically could be trying repeatedly to log in.
But to me, that begs the question. If someone is not a member, i.e. a Guest, why would it create an error (for me) and error message (for them). They're essentially just any random person on the internet. Why should that produce an SMF error?
I mean, wouldn't it be more logical for them to see a message saying 'you must register before you can log in' rather than produce an error about the referring url? Shouldn't SMF check to see if they are a member before it spits an error?
And especially if it were bots. There must be bazillions of bots surfing around the internet. Why should they trip an error for SMF if they try and fail to log in?
There must be something I don't understand about the message you referenced.
QuoteThat means themes other mods anything that has a login form.
How can I find out if a theme has a login form? I thought the themes use the same login form as the default, but it just looks different, to match the theme?
Thanks :)
Brynn, any theme that was made before SMF 2.0.14 was released will suffer from this problem (if it hasn't been updated, and marked as compatible with 2.0.14 - 15) if it has a login box, other than the one in your SMF main menu. If it has one top right, or left of the page for example then it comes from the theme.
Quote from: brynn on November 13, 2018, 05:31:40 PM
Oh, do you mean exactly like that block in the top-right corner of my default theme?
Yes exactly. Sorry was just answering that as you posted. ;)
Ok, from the instructions:
QuoteIf your custom theme has a login form, such as in index.template.php, boardindex.template.php or login.template.php, you will need to modify the theme to allow the login function to work correctly. In order to modify the theme, add the following code along with the other "hidden" input types, or anywhere before the closing </form> tag in the login form.
For each theme, will I need to make changes in all 3 of those files? Or will it only be in one of them?
Let's see if I can find one....
Oh wait. I'd better take a backup first. It's been awhile, and I'm messing around with my computer more than usual (looking to eventually switch to Linux, but for now, looking at different distros, which means constantly changing the boot sequence, and omg). But I'd better take a fresh backup before I start this.
It will probably be tomorrow or maybe this weekend before I get back to this. My backup usually takes 4 to 6 hours. Then I'll back up my computer, which only takes about an hour. And I'm typically not online much on Thurs/Fri. So if I can't squeeze it in Wed, it'll be the weekend.
I'll see you back before too long. I'd rather have a good backup, just in case ;)
Thanks again for your help!
Ok, I managed to get back tonight. For the Aqua theme, which is the forum default, which has that login block in the top-right corner, I find only
BoardIndex.template.php
index.template.php
It doesn't seem to have any login.template.php file.
index.template.php already has the proper code inside the <form> tags.
BoardIndex.template.php, there is <form> tags, but it does not have
<input type="hidden" name="hash_passwrd" value="" />
inside those tags. Does that mean that whatever kind of form it provides, it's not a login form (in that file)? (It has input type = button value)
Should I still paste in the proper code anyway?
Thanks
The Aqua theme on the theme site downloads page is already updated for SMF 2.0.14 so should contain the session check. You could compare those two files and see if you're missing those bits. Thou it should only be the login form you need to modify. The theme was updated in July 05, 2017 https://custom.simplemachines.org/themes/index.php?lemma=2631
I don't think I've updated any themes since I started my forum in 2013.
Whoa! Ok, new info. It looks like I've applied the login fix to all my themes already. I found the instructions I wrote for myself, from that older topic. But maybe I did it wrong?
This is what I did for all my themes:
Find this in each themes' index.template.php file:
<input type="hidden" name="hash_passwrd" value="" />
And replace with this:
<input type="hidden" name="hash_passwrd" value="" />
<input type="hidden" name="', $context['session_var'], '" value="', $context['session_id'], '" />
And I've checked all my themes, and they all have the same code.
Is what I did correct? If so, then I have the fix applied everywhere. But if it's wrong, how do I fix it?
But if it's correct, then where the heck is this error coming from? Since it doesn't look like it's coming from TP, should I post in the SMF forum?
That would be the correct place for this problem I think...
Quote from: tino on November 11, 2018, 12:08:26 PM
Are you sure its not just someone has bookmarked that url?
https://forum.inkscapecommunity.com/index.php?action=login2
If I click it, then I get the error as expected.
What are the IP's associated with the error log entry?
Hi tino. I had asked earlier if you wanted me to actually list the IPs. There will be quite a few, several I guess. It's not just one IP.
I'm not sure why someone would bookmark an error message??
PS - Per @rjen, I'm just about ready to post at SMF forum.
https://www.simplemachines.org/community/index.php?topic=563354.0
Quote from: brynn on November 18, 2018, 08:41:08 PM
Hi tino. I had asked earlier if you wanted me to actually list the IPs. There will be quite a few, several I guess. It's not just one IP.
I'm not sure why someone would bookmark an error message??
PS - Per @rjen, I'm just about ready to post at SMF forum.
Sorry seems I quoted myself without actually putting anything.
I meant to ask are the ips similar/same as member ones or random unrelated.
Does installing arantors mod fix the issue?
lurkalot said that Arantor has deleted his mods. But I installed all the fixes to all the themes manually, and all the portals are up to date.
I'll try to find out if these are actually members trying to log in. I didn't check already because I haven't had any complaints. But it won't hurt to double-check.
Ok, I've checked about 10 IPs (one page worth) and none are members. Probably safe to say none in all 5 pages are members, I guess.
Quote from: brynn on November 18, 2018, 09:53:49 PM
lurkalot said that Arantor has deleted his mods. But I installed all the fixes to all the themes manually, and all the portals are up to date.
I'll try to find out if these are actually members trying to log in. I didn't check already because I haven't had any complaints. But it won't hurt to double-check.
https://www.simplemachines.org/community/index.php?topic=558180.0
Well I don't know, I guess he was wrong about that. But in any case, I've applied all the fixes that I've been told about, even though I manually fixed the theme files, instead of using Arantor's mod.
Edit
Actually it looks like he was right. Follow the link to the mod and see what happens.