Part of the EllisLab Network
CodeIgniter  >   Forum Home  >  CodeIgniter Development Forums  >  Bug Reports  >  Thread
   
3 of 3
Prev
1
2
3
Sessions and encrypted cookies problem
 
Olf
Posted: 11 December 2008 11:19 AM   [ Ignore ]   [ # 31 ]  
Summer Student
Total Posts:  13
Joined  11-12-2008

Thank you for participating.

I also already are embracing the fact that once a library libmcrypt askance at my hosting. Wrote a letter to my hosting provider, but so far has disabled encryption.

Can I be in the future by CI to track the performance of the library at hosting?

And whether the situation would change if the rewrite function mcrypt_encode() under the AIP mcrypt_module_open()?

Profile
 
 
Derek Jones
Posted: 11 December 2008 11:43 AM   [ Ignore ]   [ # 32 ]  
Administrator
Avatar
RankRankRankRankRankRankRank
Total Posts:  10941
Joined  06-03-2002

Can I be in the future by CI to track the performance of the library at hosting?

I’m sorry, Olf, I do not understand this question very well.

And whether the situation would change if the rewrite function mcrypt_encode() under the AIP mcrypt_module_open()?

You could try, but I think the first thing I would try is to use $this->encrypt->set_mode() with a different mcrypt mode so it doesn’t use ECB.  Keep in mind that if you’re using encrypted sessions and autoloading sessions, you’ll have to make sure this is set in the Encryption library before it’s used.

 Signature 
Profile
MSG
 
 
Sam Dark
Posted: 18 February 2009 07:59 AM   [ Ignore ]   [ # 33 ]  
Lab Assistant
Avatar
RankRank
Total Posts:  285
Joined  02-13-2008

Recently _g00d_ at Russian forums tried to disable mcrypt:

function CI_Encrypt()
   {
      $this->CI =& get_instance();
      //$this->_mcrypt_exists = ( ! function_exists('mcrypt_encrypt')) ? FALSE : TRUE;
                $this->_mcrypt_exists = FALSE;
      log_message('debug', "Encrypt Class Initialized");
   } 

and it does not helped.

His config:

$config['encryption_key'] = "asd9f87asdfj09sd8fhsd8fa";
$config['sess_cookie_name']      = 'documents_session';
$config['sess_expiration']      = 7200;
$config['sess_encrypt_cookie']          = TRUE;
$config['sess_use_database']            = TRUE;
$config['sess_table_name']      = 'documents_sessions';
$config['sess_match_ip']      = FALSE;
$config['sess_match_useragent']         = TRUE;
$config['sess_time_to_update']       = 300;

$config['cookie_prefix']   = "";
$config['cookie_domain']   = "";
$config['cookie_path']      = "/";

$config['global_xss_filtering'] = TRUE; 

Success session starting log:

DEBUG - 2009-02-18 14:35:06 --> Config Class Initialized
DEBUG - 2009-02-18 14:35:06 --> Hooks Class Initialized
DEBUG - 2009-02-18 14:35:06 --> URI Class Initialized
DEBUG - 2009-02-18 14:35:06 --> Router Class Initialized
DEBUG - 2009-02-18 14:35:06 --> Output Class Initialized
DEBUG - 2009-02-18 14:35:06 --> Input Class Initialized
DEBUG - 2009-02-18 14:35:06 --> XSS Filtering completed
DEBUG - 2009-02-18 14:35:06 --> Global POST and COOKIE data sanitized
DEBUG - 2009-02-18 14:35:06 --> Language Class Initialized
DEBUG - 2009-02-18 14:35:06 --> Loader Class Initialized
DEBUG - 2009-02-18 14:35:06 --> Helper loaded: url_helper
DEBUG - 2009-02-18 14:35:06 --> Helper loaded: dknt_helper
DEBUG - 2009-02-18 14:35:06 --> Database Driver Class Initialized
DEBUG - 2009-02-18 14:35:06 --> Session Class Initialized
DEBUG - 2009-02-18 14:35:06 --> Helper loaded: string_helper
DEBUG - 2009-02-18 14:35:06 --> Encrypt Class Initialized
DEBUG - 2009-02-18 14:35:06 --> Session garbage collection performed.
DEBUG - 2009-02-18 14:35:06 --> Session routines successfully run
DEBUG - 2009-02-18 14:35:06 --> Controller Class Initialized
DEBUG - 2009-02-18 14:35:06 --> Helper loaded: form_helper
DEBUG - 2009-02-18 14:35:06 --> Helper loaded: html_helper
DEBUG - 2009-02-18 14:35:06 --> Model Class Initialized
DEBUG - 2009-02-18 14:35:06 --> Model Class Initialized
DEBUG - 2009-02-18 14:35:06 --> Model Class Initialized
DEBUG - 2009-02-18 14:35:06 --> Model Class Initialized
DEBUG - 2009-02-18 14:35:06 --> Model Class Initialized
DEBUG - 2009-02-18 14:35:06 --> Model Class Initialized
DEBUG - 2009-02-18 14:35:06 --> Model Class Initialized
DEBUG - 2009-02-18 14:35:06 --> File loaded: /var/www/localhost/htdocs/documents/system/application/views/upload_form.php
DEBUG - 2009-02-18 14:35:06 --> Final output sent to browser
DEBUG - 2009-02-18 14:35:06 --> Total execution time: 0.0737 

Failure log (another server):

DEBUG - 2009-02-16 13:51:06 --> Config Class Initialized
DEBUG - 2009-02-16 13:51:06 --> Hooks Class Initialized
DEBUG - 2009-02-16 13:51:06 --> URI Class Initialized
DEBUG - 2009-02-16 13:51:06 --> Router Class Initialized
DEBUG - 2009-02-16 13:51:06 --> Output Class Initialized
DEBUG - 2009-02-16 13:51:06 --> Input Class Initialized
DEBUG - 2009-02-16 13:51:06 --> XSS Filtering completed
DEBUG - 2009-02-16 13:51:06 --> Global POST and COOKIE data sanitized
DEBUG - 2009-02-16 13:51:06 --> Language Class Initialized
DEBUG - 2009-02-16 13:51:06 --> Loader Class Initialized
DEBUG - 2009-02-16 13:51:06 --> Helper loaded: url_helper
DEBUG - 2009-02-16 13:51:06 --> Helper loaded: dknt_helper
DEBUG - 2009-02-16 13:51:06 --> Database Driver Class Initialized
DEBUG - 2009-02-16 13:51:06 --> Controller Class Initialized
DEBUG - 2009-02-16 13:51:06 --> Session Class Initialized
DEBUG - 2009-02-16 13:51:06 --> Helper loaded: string_helper
DEBUG - 2009-02-16 13:51:06 --> Encrypt Class Initialized
DEBUG - 2009-02-16 13:51:06 --> A session cookie was not found.
DEBUG - 2009-02-16 13:51:06 --> Session routines successfully run
DEBUG - 2009-02-16 13:51:06 --> Helper loaded: form_helper
DEBUG - 2009-02-16 13:51:06 --> Helper loaded: cookie_helper
DEBUG - 2009-02-16 13:51:06 --> Model Class Initialized
DEBUG - 2009-02-16 13:51:06 --> Model Class Initialized
DEBUG - 2009-02-16 13:51:06 --> Model Class Initialized
DEBUG - 2009-02-16 13:51:06 --> Model Class Initialized
DEBUG - 2009-02-16 13:51:06 --> Model Class Initialized
DEBUG - 2009-02-16 13:51:06 --> Model Class Initialized
DEBUG - 2009-02-16 13:51:06 --> Model Class Initialized
DEBUG - 2009-02-16 13:51:06 --> Helper loaded: html_helper
DEBUG - 2009-02-16 13:51:06 --> File loaded: /var/www/localhost/htdocs/documents/system/application/views/upload_form.php
DEBUG - 2009-02-16 13:51:06 --> Final output sent to browser
DEBUG - 2009-02-16 13:51:06 --> Total execution time: 0.0709 
Profile
 
 
Sam Dark
Posted: 18 February 2009 08:01 AM   [ Ignore ]   [ # 34 ]  
Lab Assistant
Avatar
RankRank
Total Posts:  285
Joined  02-13-2008

DEBUG - 2009-02-16 13:51:06—> A session cookie was not found. should mean something.

Profile
 
 
Derek Jones
Posted: 18 February 2009 09:33 AM   [ Ignore ]   [ # 35 ]  
Administrator
Avatar
RankRankRankRankRankRankRank
Total Posts:  10941
Joined  06-03-2002

Sam, check the code, that means the cookie’s not even found.  Encryption’s not in play there.  Is the cookie being set?  If not, why?  Can you reproduce?

 Signature 
Profile
MSG
 
 
Sam Dark
Posted: 18 February 2009 12:35 PM   [ Ignore ]   [ # 36 ]  
Lab Assistant
Avatar
RankRank
Total Posts:  285
Joined  02-13-2008

It’s session lib, not a manual cookie setting. It’s working at one server and not working at another exactly like the issue with IV parameter.

Could it be that if cookie is not found, it caused mcrypt to generate wrong IV and the entire issue is not about mcrypt?

It can be reproduced in one environment and can’t in another.

Profile
 
 
Derek Jones
Posted: 18 February 2009 12:40 PM   [ Ignore ]   [ # 37 ]  
Administrator
Avatar
RankRankRankRankRankRankRank
Total Posts:  10941
Joined  06-03-2002

I understand that it’s the session library, but that error is logged when there’s no session cookie available - it occurs before and is unrelated to encryption, and in fact when that check fails and that error is logged, Session::sess_read() immediately returns and the code which would attempt to decrypt the session cookie isn’t even executed.

 Signature 
Profile
MSG
 
 
ginonly
Posted: 17 August 2009 05:54 AM   [ Ignore ]   [ # 38 ]  
Summer Student
Avatar
Total Posts:  1
Joined  08-17-2009

I had the same error, but in my situation everything worked good (without errors) until I had changed mbstring.func_overload in my php.ini from 0 to 2. Of course, I set it back to 0 and now CI works as before. Sorry for my English.

Profile
 
 
Derek Jones
Posted: 17 August 2009 01:30 PM   [ Ignore ]   [ # 39 ]  
Administrator
Avatar
RankRankRankRankRankRankRank
Total Posts:  10941
Joined  06-03-2002

That sounds plausible, ginonly, since that takes over string handlers in a way that will likely break encoded data.

 Signature 
Profile
MSG
 
 
   
3 of 3
Prev
1
2
3
 
‹‹ Cache Problem      xss_clean gives strange results. ››
Post Marker Legend
New Topic New posts Hot Topic Hot Topic with new posts New Poll New Poll Moved Topic Moved Topic Sticky Topic Sticky topic
Old Topic No new posts Hot Old Topic Hot Topic with no new posts Old Poll Old Poll Closed Topic Closed Topic Announcement Announcements
Theme
Change Theme
Visitor Statistics
The most visitors ever was 819, on March 11, 2010 11:15 AM
Total Registered Members: 149967 Total Logged-in Users: 43
Total Topics: 103610 Total Anonymous Users: 4
Total Replies: 518110 Total Guests: 440
Total Posts: 621720    
Members ( View Memberlist )
Newest Members:  Pauline O’Sullivan,  jonmayer,  Containere,  nikeshox,  jomsbinas,  Cyrus Mang,  Nguyen Huy,  adam1carson,  bpkrss,  ZoranM
Active Members:    adaxa,  andreagam,  aquary,  benoa,  BlazeBoy,  BobbyB,  captainill,  coolabhijit,  Cyrus Mang,  Daem0nX,  David Bauer,  dixcoder,  elambiguo,  ElToro,  Georgi Budinov,  Hoopoe,  intractve,  jacobkball,  Jamie Rumbelow,  JoostV,  keitgen,  kimo_gusatava,  kusmayadi,  LAMP Coder,  markwyner,  Maurice Calhoun,  mohanraajd,  pspvideoconverter,  regfix,  robfromnewy,  santiagofs,  schuchz,  sharpe,  sherylivingstone,  steelaz,  Sundev Lohr,  T-wrecks,  tardyace,  Tud,  vjranju,  zreedeecom,  zyddee,  _Michael_
Powered By ExpressionEngine
ExpressionEngine Discussion Forum - Version 2.1.2 (20100430)
Script Executed in 0.1685 seconds
Atom Feed   RSS 2.0