Admin Login Create Administrator Not Working

[Xpajun]

Had a problem which for some reason did something to my admin login password so decided to remove the old and create a new one...
It no longer works

error log shows the following:

Code: Select all

[11-Jul-2024 18:39:09 UTC] PHP Warning:  Undefined array key "sessiontoken" in /home/*******/public_html/store/includes/system/versioned/1.0.8.1/form.php on line 107
[11-Jul-2024 18:39:09 UTC] PHP Deprecated:  strlen(): Passing null to parameter #1 ($string) of type string is deprecated in /home/*******/public_html/store/includes/system/versioned/1.0.8.1/form.php on line 107

line 107 of form.php in versioned/1.0.8.1 (from 102-110) is:

Code: Select all

    public static function validate_action_is($action = 'process') {
      $requested_action = Request::value('action');
      $formid = $_POST['formid'] ?? $_GET['formid'] ?? null;
      if (is_null($requested_action)
       || is_null($formid)
(L107)       || (strlen($formid) !== strlen($_SESSION['sessiontoken'])))
      {
        return false;
      }

Has this been changed, if so where/when?

[burt]

I don't think there has been any recent changes in this area, that could affect functionality.

I tested on the 1.09.5 that I am currently working on;

enter admin
delete admin user
- I am automatically logged off with the "create first administrator" change to usual login page
I created an admin user.
I logged in.
Therefore all good.

I did the same steps in a 1.0.9.0;

Same result. All good.

I presume you now have an admin area that you cannot access ?

[heatherbell]

Don't know, maybe this helps, wrote it because it helped us once: https://phoenixcart.org/phoenixcartwiki ... n_Password

[burt]

T o maybe get you out of a sticky situation, you could use phpMyAdmin to insert an admin user;

Code: Select all

admin
$2y$10$m98i86gUTenOupO3Rjlpkuq8SDIvi6AJEghWE3heKu4WEDNvcPPO.

should be;
username: admin
password: pass

You would obviously change that within 5 seconds of logging in.

[Xpajun]

T o maybe get you out of a sticky situation, you could use phpMyAdmin to insert an admin user;

Code: Select all

admin
$2y$10$m98i86gUTenOupO3Rjlpkuq8SDIvi6AJEghWE3heKu4WEDNvcPPO.

should be;
username: admin
password: pass

You would obviously change that within 5 seconds of logging in.

Yes you are right - I can't access the admin area

Tried the above and got the same error - it seems to be a php 8.2 problem although it was working up until 3 days ago

[Xpajun]

Been having a think about this the error:

Code: Select all

[11-Jul-2024 18:39:09 UTC] PHP Warning:  Undefined array key "sessiontoken" in /home/*******/public_html/store/includes/system/versioned/1.0.8.1/form.php on line 107
[11-Jul-2024 18:39:09 UTC] PHP Deprecated:  strlen(): Passing null to parameter #1 ($string) of type string is deprecated in /home/*******/public_html/store/includes/system/versioned/1.0.8.1/form.php on line 107

Am I right in understanding that in line 107 of form.php in versioned/1.0.8.1 :

Code: Select all

    
      || (strlen($formid) !== strlen($_SESSION['sessiontoken'])))
   
   

the sessiontoken (is that the password) is not there causing null to being passed to parameter #1

The question would be why would it not be there?

Nothing has been changed it was all working up until BT changed my IP address which got an auto block to deny me access to my site and after sorting that the login no longer worked

[ecartz]

(is that the password)

No. That's the Cross-Site Request Forgery (CSRF) token. I could try to explain the purpose of that in depth, but my past experiences with explaining it to non-developers lead me to believe that it's a lost cause. Non-technically and shallowly, it's the thingie that checks if someone is using Javascript to hijack your admin session.

My quick thought is that I'd try truncating the session table in phpMyAdmin. Since this will mess with both admin and retail sessions, best to do it at a time when not many customers are logged in. Looking at the whos_online table in phpMyAdmin might help with that. When it's empty go ahead and truncate.

[burt]

You might also try it in a different browser, as this would create a new session.

[Xpajun]

(is that the password)

My quick thought is that I'd try truncating the session table in phpMyAdmin. Since this will mess with both admin and retail sessions, best to do it at a time when not many customers are logged in. Looking at the whos_online table in phpMyAdmin might help with that. When it's empty go ahead and truncate.

I've truncated the sessions table and still have the same problem (actually I've truncated it numerous times it doesn't half fill up quick)

You might also try it in a different browser, as this would create a new session.

Have tried this as well - same result - also tried it on my iPad on sim card to bypass my BT IP address with the same result

It is only the admin on my live store that is doing this I can log in to my test store admin with no problem, the only difference was that my test store doesn't have .htpassword (the whole test store is .htpassword protected) so i removed the .htpassword on my live store admin which hasn't made a difference either

[cbi201214337]

Hello Xpujun

The same thing happened to me.

I followed the instructions on the following page
https://phoenixcart.org/phoenixcartwiki ... n_Password.

Basically I deleted the admin user from the database with phpmyadmin.

When you enter the administration page, you must create new user and password.

I hope you find this information useful