Support Requests item #1853338, was opened at 2007-12-18 18:52
Message generated for change (Settings changed) made by nijel
You can respond by visiting:
https://sourceforge.net/tracker/?func=detail&atid=377409&aid=1853338&group_id=23067
Please note that this message will contain a full copy of the comment thread,
including the initial issue submission, for this request,
not just the latest update.
Category: None
Group: None
>Status: Pending
Priority: 5
Private: No
Submitted By: Ted Richards (tedrichards)
Assigned to: Nobody/Anonymous (nobody)
Summary: Can't login after failed login
Initial Comment:
Reproduction Steps:
1. Log in to phpMyAdmin successfully
2. Log out
3. Try to log in with an incorrect password (or none)
4. Try again with a valid user and password
The last login will fail, as will all subsequent attempts. The error is #1045 - Access denied for user: 'XXX@...' (Using password: ...
If you try it with no password in step three, the error message will always say "Using password: NO", even if you enter one in subsequent attempts.
Deleting the phpMyAdmin cookie in the browser corrects the problem, as does closing and reopening the browser.
If you omit steps 1 and 2, it will work OK.
This did not happen in 2.9.2.
Versions:
phpMyAdmin: 2.11.2.1 and 2.11.3
PHP: 4.4.7
MySQL: 3.23.47
Browser: Firefox 2.0.0.11
Authentification Method: cookie
----------------------------------------------------------------------
Comment By: Michal Čihař (nijel)
Date: 2008-11-28 12:13
Message:
Does this still happens with current version?
----------------------------------------------------------------------
Comment By: Ted Richards (tedrichards)
Date: 2007-12-19 22:52
Message:
Logged In: YES
user_id=1962722
Originator: YES
OK. Here's a cut-and-paste from "View page source", after step 3 and after
step 4. The steps taken were the same as before.
File Added: bad.php.html2.tgz
----------------------------------------------------------------------
Comment By: Sebastian Mendel (cybot_tm)
Date: 2007-12-19 21:55
Message:
Logged In: YES
user_id=326580
Originator: NO
thanks for your effort - but it seems, when hitting save page, the browser
loads the page again from the webserver
please ttry again, this time with mouse context menu 'VIEW SOURCE' copy
and paste all
according to phpinfo() output their is missing the login form submitted
data:
_REQUEST["lang"] en-iso-8859-1
_REQUEST["token"] a67834da2ddc2a26c206d33bc1451ea1
_REQUEST["pma_lang"] en-iso-8859-1
_REQUEST["pmaCookieVer"] 4
_REQUEST["pmaUser-1"] Z+6ygAoNb/4=
_REQUEST["pma_charset"] iso-8859-1
_REQUEST["phpMyAdmin"] 20039efd718ea6bac3e3c185e76d1021
_REQUEST["pma_fontsize"] 82%
_REQUEST["pmaPass-1"] nVaJ8I7Xrlw=
_REQUEST["db"] no value
_REQUEST["table"] no value
_REQUEST["sql_query"] no value
_REQUEST["js_frame"] no value
----------------------------------------------------------------------
Comment By: Ted Richards (tedrichards)
Date: 2007-12-19 19:49
Message:
Logged In: YES
user_id=1962722
Originator: YES
I called the functions you suggested at the beginning of PMA_auth, except
that debug_print_backtrace() is only available in PHP 5, so I used
var_dump(debug_backtrace()) instead.
I saved the resulting page and attached a gzip'd version of it.
What I did was:
1. Log in as papa (password "papa")
2. Log out
3. Try to log in as papa with password "papa1" - it failed.
4. Try to log in as mama with password "mama", which is valid - it
failed.
5. Did a File->Save As
Regarding the blank entry, I did the following:
1. Log in as papa (password "papa")
2. Log out
3. Try to log in as papa with password "papa1" - it failed.
4. Try to log in as mama with password "mama", which is valid - it
failed.
5. Log in with a blank username and password - it succeeded and logged me
in as mama!
Sometimes doing that will just clear the error and redisplay the blank
login form. I can't figure out a pattern to which it does.
File Added: bad.php.html.tgz
----------------------------------------------------------------------
Comment By: Sebastian Mendel (cybot_tm)
Date: 2007-12-19 17:23
Message:
Logged In: YES
user_id=326580
Originator: NO
so it seems to be a session problem - deleting "phpMyAdmin" results in
starting a completely new session
it would be nice if you could submit the whole output of phpinfo(),
var_dump($GLOBALS) and debug_print_backtrace() called from PMA_auth() in
libraries/auth/cookie.auth.lib.php inside step 4 (4. Try again with a valid
user and password)
info_sebastianmendel_de
----------------------------------------------------------------------
Comment By: Ted Richards (tedrichards)
Date: 2007-12-19 16:00
Message:
Logged In: YES
user_id=1962722
Originator: YES
All versions were built from source. I have specified the authentification
method as 'cookie' and supplied a Blowfish secret.
The cookie I am talking about deleting is literally "phpMyAdmin", which is
the [default] session name. As far as I can tell, deleting the pmaPass-1
and pmaUser-1 cookies make no difference. The only thing that matters is
deleting the phpMyAdmin cookie.
I have also seen strange results if I resubmit the form with a blank user
and password. Sometimes it fixes things so that I can then log in with a
valid user and password. Sometimes it actually logs me in as the previous
valid user even though the user and password were blank.
----------------------------------------------------------------------
Comment By: Marc Delisle (lem9)
Date: 2007-12-19 14:46
Message:
Logged In: YES
user_id=210714
Originator: NO
Moved to support.
----------------------------------------------------------------------
Comment By: Sebastian Mendel (cybot_tm)
Date: 2007-12-19 08:38
Message:
Logged In: YES
user_id=326580
Originator: NO
how did you upgraded your phpMyAdmin installation?
what cookies (their exact names) you are deleting?
----------------------------------------------------------------------
Comment By: Ted Richards (tedrichards)
Date: 2007-12-18 20:46
Message:
Logged In: YES
user_id=1962722
Originator: YES
The SAPI is CGI/FastCGI.
----------------------------------------------------------------------
Comment By: Marc Delisle (lem9)
Date: 2007-12-18 20:14
Message:
Logged In: YES
user_id=210714
Originator: NO
SAPI = Server API; this is visible from "show PHP information" on the main
phpMyAdmin page, or if you execute this script:
<?php phpinfo(); ?>
----------------------------------------------------------------------
Comment By: Ted Richards (tedrichards)
Date: 2007-12-18 20:02
Message:
Logged In: YES
user_id=1962722
Originator: YES
By the way, the error message alsways shows the user and password state
(YES/NO) from the original error, not the ones most recently entered. That
would seem to indicate that it is getting them from the cookies (or
something), and ignoring the form data.
----------------------------------------------------------------------
Comment By: Ted Richards (tedrichards)
Date: 2007-12-18 19:56
Message:
Logged In: YES
user_id=1962722
Originator: YES
The web server is Apache 1.3.29 (this is on Linux). How do I tell what the
SAPI is?
----------------------------------------------------------------------
Comment By: Marc Delisle (lem9)
Date: 2007-12-18 19:17
Message:
Logged In: YES
user_id=210714
Originator: NO
Cannot reproduce (but I don't have MySQL 3.23.47 near me to test). Which
web server and SAPI are you using?
----------------------------------------------------------------------
You can respond by visiting:
https://sourceforge.net/tracker/?func=detail&atid=377409&aid=1853338&group_id=23067
|
