Closed (cannot reproduce)
Project:
Persistent Login
Version:
6.x-1.4
Component:
User interface
Priority:
Normal
Category:
Support request
Assigned:
Unassigned
Reporter:
Created:
11 May 2012 at 12:28 UTC
Updated:
4 Jan 2016 at 06:43 UTC
Jump to comment: Most recent
Comments
Comment #1
gapplepersistent login by default resticts access to user modification and administration pages as a security measure. This prevents someone who gains access to an account through a stolen token pair or open session from being able to modify the account and hijack it from the legitimate user.
Persistent login's check that the user has authenticated themselves via their username and password must come earlier in the bootstrap process than the page access callback, therefore a user will receive the login screen before it can be evaluated whether they really should have access to the page or not. Once they have authenticated with their password (either when prompted after first accessing the site via PL, or if they logged in to the site initially), persistent login has no role in the page load, and the user's access is dependent on their roles' permissions.
In order to verify any bugs:
is the user prompted to log in again, even if they do not use the 'remember me' feature?
Remove all of the user's stored PL tokens, log in without selecting the 'remember me' option, and then access the desired page - the login screen should not appear.
can the same user access the edit page without persistent login enabled?
Comment #2
bartezz commentedHere are my findings;
1) With PL disabled access to user/edit is no problem
2) With PL enabled the first time logging in with 'remember me' function access to user/edit is no problem
3) With PL enabled auto logging in with 'remember me' function after browser reboot access to user/edit is a problem
3) With PL enabled auto logging in without 'remember me' function upon browser reboot is ofcourse not happening like it would without the PL module enabled (cookie lifetime is altered ofcourse)
Do you need any further information?
Cheers
Comment #3
gappleIs the user correctly redirected after the login? Or are they redirected to a page different than their original request which they do not have access to?
are they able to continue accessing other areas of the site after they log in when prompted, or are they then treated as an anonymous user?
the only other issue that I can think may be related is
#897868: Failure when Global Redirect de-slash enabled
Comment #4
bartezz commentedAs mentioned in OP, with PL enabled the user is redirected to an access denied after entering details upon requesting the user/edit page. All other restricted areas are accessible just fine.
So when visiting the site via a PL login and trying to access a user/edit page I'm being sent to;
/en/user/login?destination=user%2F142%2Fedit%3Fdestination%3Dadmin%252Fuser%252Fuser
Thereby shown the error; Please verify your username and password to access this page.
Now when entering login credentials here I'm sent to;
/en/user/login?destination=user%2F142%2Fedit%3Fdestination%3Dadmin%252Fuser%252Fuser
Thereby shown; Access denied You are not authorized to access this page.
Comment #5
iva2k commentedDo you also have session_restore.module installed? If yes, you are seeing #542540: Make session_restore.module compatible with persistent_login.module.
I just encountered this exact same problem on D7 with session_restore enabled as well. I pasted patch from #542540: Make session_restore.module compatible with persistent_login.module and issue went away (after caches clear).
Comment #6
bartezz commentedHi,
No session restore installed, thanx for posting tho!
Cheers
Comment #7
gappleis it correct that the page url doesn't change after logging in?
After you are prompted to log in, if you go back and attempt click through to edit link again are you still asked to log in?
Comment #8
zerolab commentedI can confirm the issue.
Steps to reproduce:
1. Log in with PL "remember me"
2. go to user/UID/edit -> OK
3. delete the session cookie, leaving the PL one.
4. go to user/UID/edit -> get redirected to user/login?destination=user%2FUID%2Fedit
5. enter login details -> get redirected to user/login?destination=user%2FUID%2Fedit
6. access user/UID/edit directly -> get redirected to user/login?destination=user%2FUID%2Fedit with "cannot show you this page" as you are already logged in user/login checks for
user_is_anonymous()Cheers
Comment #9
zerolab commentedBtw, the patch from #1955996: Unable to access restricted pages when other requests happen on login page fixes this issue.
It didn't apply cleanly, so I did it by hand. Will try again in the evening to make sure I did not miss any test code that may have triggered the fail. Otherwise will generate a fresh patch against 6.x-1.x
Comment #10
deanflory commentedI'm getting this when trying to go to the Persistent Login admin page:
/user/login?destination=admin/config/system/persistent_login
Each time I submit the login form, it logs me in and redirects me right back to the same page listed above. I am using the Better Login module but I don't see how that would affect the destination part not kicking-in after submission.
Trying the patch from here now: #1955996: Unable to access restricted pages when other requests happen on login page
EDIT: My issue was fixed by disabling, uninstalling, running cron, flushing cache twice and then re-enabling the Persistent Login module.
Comment #11
gappleSince this issue hasn't received any updates or clarification in a long time, I'm closing pending further information.