Skip to content

[2.1] Ensure we set the cookie when presenting the login form #9167

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
jdarwood007 wants to merge 9 commits into
base: release-2.1
Choose a base branch
from
Open

[2.1] Ensure we set the cookie when presenting the login form #9167

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
9 commits
Select commit Hold shift + click to select a range
498e124
[2.1] Ensure we set the cookie when presenting the login form
jdarwood007 Mar 22, 2026
c7f1002
Cookies need to be set if we are kicking guests
jdarwood007 Mar 22, 2026
448d881
Need cookies to login even in maintenance mode.
jdarwood007 Mar 22, 2026
7e0dc23
Missed a global
jdarwood007 Mar 22, 2026
198791f
To avoid creating cookies, use a different template
jdarwood007 Mar 22, 2026
0572818
Improved bot abuse on KickGuest and InMaintenance
jdarwood007 Mar 22, 2026
2e1444f
Reverted changes
jdarwood007 Mar 23, 2026
df08d17
Reverted too much, restore a commit
jdarwood007 Mar 23, 2026
8619ae9
Another case of a failed session login
jdarwood007 Mar 25, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
6 changes: 6 additions & 0 deletions Sources/LogInOut.php
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -82,6 +82,11 @@ function Login()
'name' => $txt['login'],
);

// Ensure the session data persists.
if (empty($_COOKIE)) {
setLoginCookie(60 * $modSettings['cookieTime'], 0, '');
}

// Set the login URL - will be used when the login process is done (but careful not to send us to an attachment).
if (isset($_SESSION['old_url']) && strpos($_SESSION['old_url'], 'dlattach') === false && preg_match('~(board|topic)[=,]~', $_SESSION['old_url']) != 0)
$_SESSION['login_url'] = $_SESSION['old_url'];
Expand Down Expand Up @@ -263,6 +268,7 @@ function Login2()
// Cookies are required...
if (empty($_COOKIE))
{
setLoginCookie(60 * $modSettings['cookieTime'], 0, '');
$context['login_errors'] = array($txt['login_cookie_error']);
return;
}
Expand Down
10 changes: 8 additions & 2 deletions Sources/Subs-Auth.php
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -210,11 +210,14 @@ function url_parts($local, $global)
*/
function KickGuest()
{
global $txt, $context;
global $txt, $context, $modSettings;

loadTheme();
loadLanguage('Login');
loadTemplate('Login');
if (empty($_COOKIE)) {
setLoginCookie(60 * $modSettings['cookieTime'], 0, '');
}
createToken('login');

// Never redirect to an attachment
Expand All @@ -232,10 +235,13 @@ function KickGuest()
*/
function InMaintenance()
{
global $txt, $mtitle, $mmessage, $context, $smcFunc;
global $txt, $mtitle, $mmessage, $context, $smcFunc, $modSettings;

loadLanguage('Login');
loadTemplate('Login');
if (empty($_COOKIE)) {
setLoginCookie(60 * $modSettings['cookieTime'], 0, '');
}
createToken('login');

// Send a 503 header, so search engines don't bother indexing while we're in maintenance mode.
Expand Down
Loading