Automatic logout (new and recent)

Post by **}TCP{Wolf** » Thu Jun 01, 2006 12:24 pm

For about a week now, I have a problem on this phpBB board, but not just this one, others as well. I am suspecting that the boards were recently upgraded and a security feature is giving me a hard time.

From work, I can no longer use this board, because I get logged out automatically all the time.

I figured, it probably has something todo with the fact, that our work proxy has more than one IP address seen in the internet, and whichever one is used is random all the time. So effectively, my IP addresses changes constantly from one page to another.

I have a security precaution in one of my own applications that prevents continuing a session when a session ID is sent from another IP address as it originated from, killing it and forcing the user to login again. I am guessing, a recent update of phpBB has a similar feature that does exactly the same.

Carnage, you couldn't by any chance enable for my account "roaming IPs" during a session or to kill the "feature" for my account...?

Post by **}TCP{Carnage** » Thu Jun 01, 2006 4:06 pm

Well no forum update has been added here in quite some time now

And i have taken a look at the cookie feature but that is not user by user sellectable .. sorry m8 can't help ya there

Post by **}TCP{Wolf** » Thu Jun 01, 2006 7:46 pm

GOOGZ · Post by **GOOGZ** » Thu Jun 01, 2006 10:09 pm

i visit a few a forums, i dont have a problem here, ..but i do have a problem on the DOG website, despite selecting auto log in, i keep having to re - login when i go to their forum,....i've tried pretty much everything regards cookies and that, but still have the problem..... wierd,..

anyways, just found this interesting wolf,...maybe somink similar with me

ps..i don't seem to be the only one with this prob at Newbies DOG forum

Post by **}TCP{Ramses** » Fri Jun 02, 2006 12:25 am

We had a problem like that a few months back on this forum but the wizard Carnage fixed it

.

Post by **}TCP{Carnage** » Fri Jun 02, 2006 8:33 am

I will see if i can find some hack for the cookie account being per user settable .

Xavious · Post by **Xavious** » Fri Jun 02, 2006 8:43 am

Version 2.0.20 is out you know... Try updating.

Post by **}TCP{Carnage** » Fri Jun 02, 2006 10:55 am

have u read the updates ? ... no need to update

Post by **}TCP{Wolf** » Fri Jun 02, 2006 7:54 pm

I asked {hLk}Havok to look into it.

Guess what:

1) I was absolutely right about the security feature. It is EXACTLY what I suspected it!

2) HAVOK FOUND THE SOLVE
http://www.phpbb.com/kb/article.php?article_id=54

Now before you go edit the php code, Havok suggestede I try a public anonymizer proxy first. I will do that and if that doesn't work you can still apply it. However, it's really good to know to be right hghehehe

Post by **}TCP{Wolf** » Fri Jun 09, 2006 4:01 pm

Turns out using an anonymizer proxy does NOT do the trick.

Carnage, let me know if you feel confident with editing out the responsible PHP code (don't do it if you're not sure about it).

Post by **}TCP{Carnage** » Fri Jun 09, 2006 4:21 pm

Sure i can edit that we also have some other security stuff in place

Post by **}TCP{Wolf** » Fri Jun 09, 2006 4:23 pm

Great, will try from work again next week

Post by **}TCP{Carnage** » Fri Jun 09, 2006 4:56 pm

Err i will see if i can fix it this weekend

Ow just set up a little proxy myself could u give that a try aswell

http://www.oortjes.nl/Ooren/temp/phproxy.php

reports a little bug on top but will fix that later if it works for u

Post by **}TCP{Wolf** » Sat Jun 10, 2006 10:51 am

k, will try that proxy first thing on Monday from work

Post by **}TCP{Carnage** » Mon Jun 12, 2006 8:45 pm

Any luck with that proxy m8 ?

If not i will start changing the files

www.tcpclan.net

Welcome to the Board

Automatic logout (new and recent)

Automatic logout (new and recent)