Category: Cookie

According to http://phplens.com/lens/adodb/docs-session.htm, garbage collection is supposed to be automatic for adodb sessions, which are used in tiki when "store sessions in db" is turned on. But it does not seem to be working. Have to figure out why first, before I can fix.

On many machines, and with both Firefox and IE, attempting to login as a user or admin results in an error message "You have to enable cookies to login to this site". Both in IE and Firefox cookies are enabled.

This problem has shown up recently on Tiki.org forums

"Forums » Architecture/Installation » You have to enable cookies to be able to login to this site"

It has also been reported as a bug "Cookies with Tiki 6.1"

__Off/on__

Seems to disappear when I use a different theme, "darkroom" instead of "jqui"

comzone, the cookie that save the show/hide of comments on tikiWiki pages, isn't being updated properly. Once comments are shown they remain shown.

To reproduce the issue, follow the following instructions:
- activate comments for you TikiWiki page, through your admin controls
- Open a new session of your web browser. I'll assume you're using Firefox from now on
- Navigate to one of you wiki pages
- Scroll down to the bottom of your wiki page
~ Notice how the 'Post New Comments' comments section is hidden
- Click the link to add comments and make the 'Post New Comments' visible
- In Firefox, select Tools-> Options. Go to the privacy section and click on Show Cookies. Search for your site or site subdomain (type the first letter of the domain or subdomain to jump to that letter) where your tikiWiki is. Expand the folder and search for comzone. Notice that comzone is set to 'o'. Close out the cookies and option window.
- Browse to another page on your tikiWiki site and scroll down to the bottom of the page
- Notice that the 'Post New Comments' section is still visible
- Click on the add comment link to collapse the comments section.
~ At this point the comzone cookie should have changed.
- Check on the content of comzone and see if it is something other than 'o'. You will find that it doesn't change.
- Delete the comzone cookie and refresh the wikipage and you'll see that comments get hidden.

1) Column colapsing is not remerbered whenever I change from one page to another.

2) And also have had some problems with their navigators saying "cookies must be on" when they are on, no matter wich browser is being used. This happends as they attemp to login. After many tries the user can login.


Using:
Tiki 6.1 fresh code install, on past 6.0 db updated to 6.1.

XSS SECURITY ISSUE ::

This has been reported to Security Team.

Best Regards,
sschurtz (s.schurtz@infoserve.de)

__Background:__ I'm in the process of an overdue upgrade of two Tikis from version 2.2 to the new LTS version 6.x. Testing and adaptation of styles was done on XAMPP localhost under Windows and all worked fine. Problems began with installing on public server (Debian). Installation is done from shell (tar.gz and running setup.sh) and a fresh install works fine.

__Problem:__ When I use the existing database (no problems at database upgrading to 6.2 reported) then it also works fine for anonymous user. But as soon as I try to login as admin user, I get a long wait and then:

__Fatal error:__ Out of memory (allocated 110100480) (tried to allocate 157 bytes) in /home/hrusccbo/tikitest.hruschka.com/tiki-6.2/lib/init/initlib.php on line 185
''(Note: the line number 185 varies)''

In order to locate the error, I entered the following line in initlib:

171: print ("a:$errno, b:$errstr, c:$errfile, d:$errline");

The result is that Tiki starts displaying thousands of times, in an endless loop, until memory exhaustion:
a:2, b:DateTimeZone::__construct() [datetimezone.--construct]: Unknown or bad timezone (M), c:lib/tikidate-php5.php, d:182

From that I deduct that the error originates from line 182 of tikidate-php5.php


===Some other findings which might be useful:===

The last days I tried to enter dev.tiki.org and themes.tiki.org, but could not because the sites displayed exactly the same error. Yesterday I went to IRC chat and was advised to clear the cookies of my browser. After that it worked.

Looking at the cookies now, I found that "local_tz" (I assume that has to do with timezone) of my working tw_2.2 had the content "22%3A37%3A23", the cookie from tiki.org has now the content "UTC", but the cookies from working XAMPP/localhost and from the not working Debian 6.2 installation have both the content "M".

This fits to the origin of the error, as line 182 is "function setTZbyID" which calls "function convertMissingTimezone", where "M" is used in a switch/case statement.

But probably the bug is not really in the tikidate script, but where the cookies are set !!! (see below under "workaround")

Hope that helps to locate the bug and that it can be solved in 6.3. In the meantime I'll wait with migrating.

Thanks to all of you for your great work.
Felix
(running 3 tiki sites since 2005)

The "Remember me" feature of login on tw.o sites doesn't really work as it should. On tw.o, dev.tw.o and themes.tw.o it's set via Admin > Login to values "tikiwiki, .tikiwiki.org, /, 1 week" and it lasts only some hour or so and expires then. It's annoying to relogin many times a day.

First of all thanks for tikiwiki

Major SECURITY ISSUE ::

This has been reported to security.tikiwiki.org

Using the same IIS web site:
*You can install 6.0 and successfully login as admin.
*Install 6.1 and 6.2 but neither of them are able to login as admin.

Additional details, as per forum post (http://tiki.org/tiki-view_forum_thread.php?comments_parentId=40416&topics_sort_mode=lastPost_desc&forumId=6):
Trying to use TW on our IIS web site. Have followed all references I could find but have not been able to get 6.1 going.

As a test, I have managed to get 6.0 going, so not sure why 6.1 and 6.2 has issues. Any guidance on how to debug this is appreciated.

Thanks.

Details are:
- Win2003 SP2 and IIS6
- MySQL 5.1 (tried both local and remote server)
- PHP 5.2.17
- Firefox 3.6
- No tildes in the URL
- Tried placing TW in the root of the web site and as a virtual directory
- Have granted the EVERYONE user READ,WRITE & MODIFY access to the web root and all sub folders.
- No PHP errors recorded in the PHP error log

Symptoms:
- Install proceeds successfully.
- DB install states that is is successful (both local and remote DB scenarios)
- Prompted with admin change password screen and successfully change the password.
- Prompted with the Home page, then login as admin and new password, only to be presented with the Home page again, which states:
"Congratulations
This is the default homepage for your Tiki. If you are seeing this page, your installation was successful.

You can change this page after logging in. Please review the wiki syntax(external link) for editing details."

- Try clearing cookies, then logging in and are presented with "You have to enable cookies to be able to login to this site".