Community Forums

by **logansryche** » Wed Jun 29, 2011 11:00 pm

Running a clean install of v1.5.0.5
every time I log in to the admin, it says invalid token and lists a token in the url. After I log in again, it will again tell me invalid token and the token will change. I usually have to keep at it before it lets me in, and even then when I go to edit something, it'll bring me back to the log in window and tell me invalid token. Store is located at http://fei.x10.mx/store ADMIN located at http://fei.x10.mx/store/admin

What I've done:
Cleared out browser cache/pc cache... nothing
Deleted and recreated the DB... nothing
Changed password... nothing
I did install a payment module for bitcoins, but I unstalled it and nothing
added some snippet of code to both files in root and admin php files... gave me an error, so i deleted the snippets
made sure i'm using the correct versions of software required and I am.. even have the db set to localhost
tried in both firefox, IE8, and chrome and still gives invalid token.

I'm tearing my hair out over this!

by **logansryche** » Thu Jun 30, 2011 7:36 pm

What, has no one ran into this? I mean, it's getting very annoying to repeativly enter my admin password 8 or 9 times just to get to an area or update a product - no cart software should act like this.

by **rph** » Thu Jun 30, 2011 7:49 pm

Make sure you're not connecting through a proxy and there are no problems with your host.

by **logansryche** » Thu Jun 30, 2011 9:58 pm

I'm neither connecting by proxy or having host problems.
I just tried loging in and the problem still exists. Is there a way to take this token verification out so I can add product to my store?

by **rph** » Thu Jun 30, 2011 11:01 pm

Not easily.

Have you tried using a different computer?

by **logansryche** » Fri Jul 01, 2011 3:45 am

I have. Tried it on both the lappy(win7) and the desktop in the living room(also win7) and has the same problem.

by **rph** » Fri Jul 01, 2011 6:10 am

If you want to create a restricted access user account and PM the details to me I can try to log in. That'll narrow down whether the issue is your host or your net access.

by **logansryche** » Fri Jul 01, 2011 6:26 am

PM'd you rph..

by **rph** » Fri Jul 01, 2011 7:34 am

The problem is definitely server side.

I noticed you didn't delete the install folder. That definitely should be done. Also, is this a 100% clean reinstall? Clean database and install files/folder? I'd also check and make sure the subdomain is properly set up and configured.

by **logansryche** » Fri Jul 01, 2011 10:50 pm

Everything was a reinstall, but reinstalled it and the MySQL db just to make sure and everything's the same. Its something i'm going to have to deal with I guess untill someone can tell me A: how to fix it or B: tell me how to get rid of this token auth system

by **Xsecrets** » Sat Jul 02, 2011 12:24 am

logansryche wrote:Everything was a reinstall, but reinstalled it and the MySQL db just to make sure and everything's the same. Its something i'm going to have to deal with I guess untill someone can tell me A: how to fix it or B: tell me how to get rid of this token auth system

well getting rid of the token auth system will not be easy. You would have to edit every single catalog file in the entire admin folder, in addition that would open you back up to the csrf attack that it was put in place to prevent.

It's not a complicated system if it is not working for you there is some sort of problem with sessions on the server, and you will most likely have problems with the storefront logins as well.

by **logansryche** » Sat Jul 02, 2011 1:23 am

Ok so how do I fix this then? I mean, I can run OSCommerce without any issue.
I switched over to Open Cart specifically for the bitcoin plugin.

by **Xsecrets** » Sat Jul 02, 2011 1:40 am

I have no idea how you fix it I've worked on LOTS of installs and I've never seen anyone have that problem.

by **rph** » Sat Jul 02, 2011 1:54 am

I really don't think it's the token but you can try installing OpenCart 1.4.7 which is the last version before tokens were added and see what happens.

by **logansryche** » Sat Jul 02, 2011 5:07 am

Ok. Got 1.4.7 installed, redid MySQL and it looks like we're good to go. Weird how 1.4.7 works, but 1.5.0.5 doesn't.

by **Xsecrets** » Sat Jul 02, 2011 2:27 pm

It must mean that there is something wrong with your session on the server. If you add something to the cart and click continue shopping does it stay in the cart?

by **logansryche** » Sun Jul 03, 2011 2:32 am

I dunno about 1.5.0.5, but it will go through the shoping cart process in 1.4.7
I won't sit there and enter my login 8+ times to attempt to add a product to test the cart process.
This is seriously something that needs to be fixed. Also tried 1.5.0 and same problem with tokens on admin login.
Looks like I'm staying with 1.4.7 because of this.

by **bestpro** » Wed Dec 07, 2011 6:43 am

I'm stuck with the issue too: if I don't entry the token in url string I've receiving the error.
It' surely the bug

So I deeped in the code and found in admin/controller/common/login.php:
(I've added dump instruction)

if ((isset($this->session->data['token']) &&
!isset($this->request->get['token']))
|| ((isset($this->request->get['token']) &&
(isset($this->session->data['token']) &&
($this->request->get['token'] != $this->session->data['token']))))) {
var_dump($this->session);
$this->error['warning'] = $this->language->get('error_token');
}

So you can see that session variable is existing, but the system checks for get['token']==session['token'] and errors if not.

I've tryed to comment
//$this->error['warning'] = $this->language->get('error_token');
it not worked for me

So I've found simple workaround:
in admin/index.php

after
// Front Controller
$controller = new Front($registry);

add this hack (if url token is empty - so simple use session token):

//token hack:
if (isset($session->data['token']) && !isset($request->get['token'])
) {
// var_dump($this->session);
$request->get['token'] = $session->data['token'];
}