Possible bug in acp features before acp login?

[Dragosvr92]

If you load a users page, but you are not logged in the ACP, clicking the Administer user link gets you on the board index, instead to the linked acp page.

(This can be done if you load the user page, then open Administration Control Panel in a tab. Or if you opened the user page in a tab and then clicked the acp link from your index page.)

Reloading the user page fixes it and the link gets properly loaded, instead of redirecting you to the board index.
Should i be opening a bug ticket for this, or its far too complicated to fix it for 3.1... or whatever?

[DavidIQ]

I'm not seeing that. Maybe you need to check the cookie settings? What I usually see happening is that the SID "cycles" and then it's no good to get into the ACP for some reason.

[Dragosvr92]

After i first noticed the error behaviour, i cleared out all my site cookies and tried the login steps again. It reproduced the very same error.

[Lady_G]

In addition to cookie settings, I would suggest purging the system cache. This will ensure both the server-side and browser caches start from a known (clean) setting.

[Dragosvr92]

• Purged Cache.
• Cleared all site cookies.
• Went to board index.
• Logged in forum.
• Went to a user profile page.
• Opened the ACP page in a new tab and logged in.
• Clicked Administer user on the user profile page i had open.
• The same issue.

I am running 3.1.8.

[Lady_G]

Your description helped. I have reproduced your problem with the 3.1.x repository install (latest). I have updated the steps:

• Login as administrator
• Purged Cache.
• Logged out, cleared all browser cookies
• Went to board index.
• Logged into forum as administrator, check "Remember me" box.
• Went to a user profile page.
• Opened the ACP page in a new tab and logged in.
• Clicked Administer user on the user profile page i had open.
• The same issue.

At the last step (returning to the Board index after clicking on Administer user), the URL is pointing to cache ("sid=").

Code: Select all

http://localhost/phpbb/phpBB/index.php?sid=69f604bb1da21a22aeabe9d434db9e3a

I navigate the forum, then:

• Went to a user profile page.
• Clicked Administer user on the user profile

I go directly to the Administration Control Panel.

My guess : Perhaps an unforeseen condition (two browser windows open simultaneously) is causing a permissions problem. The result is to go to the Board Index as a way to protect permissions.

I will defer to the experienced developers for additional comments.

[DavidIQ]

One tab has one SID while the other has another SID. I'm not seeing how we could do anything about that. The SID you have loaded in the browser tab where you have the profile open is invalidated after you log in to the ACP in the other tab. I'm assuming a cookie is being set after you log in to the ACP that causes the other page to get confused because there is now a cookie present that says you have validated for an ACP session but your actual SID does not match. I'm going to say this is more user error than an actual bug.

[Dragosvr92]

... Which is why i dislike the sid. It should just be stored in a Cookie and be overwriten by the new one. Not to be stored in the url.