PHPList in an endless login loop

ℹ️ Support
1

Hello,

I’ve used PHPList for many years successfully. However, I have just installed a new copy of version 3.6.16 and I’m running PHP 8.2. I have tried PHP 7.4 too. I can login but when I select anything, I’m logged out again. I have tried every browser I have and indeed another computer. Its doing my head in as I need to do an urgent newsletter. All other instances of PHPList I have (probs older versions) work fine. Cookies and sessions cleared too … Happy to let someone login if it helps?

Thanks

2

My other sites are running 3.6.14 all ok!

3

@WestWing Check whether you have an IP V6 address. phplist 3.6.16 doesn’t handle that properly.

4

Thanks for answering Duncan …. I have no IP V6 addresses … like I said, 3.6.14 works fine off the same server. I’m not sure how to install 3.7 yet …. I may have to try that. I certaintly will not upkrade any other sites to .16!

5

@WestWing You can try renaming the admin_login table to something else. That would remove one possible cause of the problem.

When you are logged-out, does the browser URL have an “err=” parameter? Values of 1 and 2 have slightly different causes.
Also, look in the eventlog table to see whether phplist has logged anything.

6

Hi Duncan,

err=” parameter 1. is what i get. Nothing in the eventlog table ….

7

also, I renamed the admin_login table as you suggested to no effect … still being logged out!

8

@WestWing This is the code that issues err=1

if (isset($_GET['tk']) && isset($_SESSION[$GLOBALS['installation_name'].'_csrf_token'])) {
    if (!hash_equals($_SESSION[$GLOBALS['installation_name'].'_csrf_token'], $_GET['tk'])) {
        $_SESSION['logout_error'] = s('Error, incorrect session token');
        Redirect('logout&err=1');
        exit;
    }
} elseif ($enforce && isset($_SESSION[$GLOBALS['installation_name'].'_csrf_token'])) {
    $_SESSION['logout_error'] = s('Error, incorrect session token');
    Redirect('logout&err=1');
    exit;
}

That seems to indicate something wrong with the php session. The code is comparing the tk parameter from the URL with a session variable. The tk parameter was set from that session variable when the page was generated, so they should be the same.

9

Thanks Duncan …. not sure where to go next. I installed a fresh PHPList .16 on another site and its the same. Any idea when 3.7.0 will be released?

10

@WestWing Are all your phplist installations on the same web hosting server? If not, can you see if there are any differences in php settings between them, specifically to do with the php session handling.

You can try to work around this problem by patching file lists/admin/lib.php. Look for these lines (they are at line 1844 in the version that I am looking at)

function verifyCsrfGetToken($enforce = 1)
{ // enforce=0 allows checking "if exist"

then add this immediately afterwards, which will bypass the check

return true;
11

Tried your code alteration Duncan but still the same.

FYI, all my 5 instances of PHPList are on the same server.

Thanks for trying.

12

@WestWing Try installing version 3.6.14 if that is working for other sites.