venividi
Member
Having upgraded wordpress to v.2.8, I found intergration problem.
Log in bbpress, automatic log out from wordpress,
log in wordpress, automatic log out from bbpress.
my bbpress v. 0.9.0.5
What's the cause of such a problem.
I'll be greatly appreciated if any one solve the problem.
Thanks.
venividi
Member
My bbpress .9.0.5 and wordpress 2.7.1 worked perfectly until upgrade of wordpress 2.8
1. upgrade of bbpress .9.0.5 - 1 hour after the posting. ( a week ago? )
2. upgrade of wordpress 2.8 - 2 hours ago.
3. the break of cookie - right after the upgrade of wordpress
We have the same problem today with the FBC-Plugin.
I seems to be a "hot" topic - and that's probably the reason why we search for the last 2 hours for a solution. :) *selfironic*
Here the cookie-names and paths - they are identical. So the error eventually is not in seeting the cookies, but in reading of the cookies. !?
After Login in Wordpress
wordpress_logged_in_672b8ff18484c1d9d7de0f05d907543d - Path: /wp/
wordpress_logged_in_672b8ff18484c1d9d7de0f05d907543d - Path: /
wordpress_672b8ff18484c1d9d7de0f05d907543d - Path: /wp/wp-content/plugins
wordpress_672b8ff18484c1d9d7de0f05d907543d - Path: /wp/wp-admin
After Login in BBpress
wordpress_logged_in_672b8ff18484c1d9d7de0f05d907543d - Path: /wp/
wordpress_logged_in_672b8ff18484c1d9d7de0f05d907543d - Path: /
wordpress_672b8ff18484c1d9d7de0f05d907543d - Path: /
wordpress_672b8ff18484c1d9d7de0f05d907543d - Path: /wp-admin
wordpress_672b8ff18484c1d9d7de0f05d907543d - Path: /wp/wp-admin
wordpress_672b8ff18484c1d9d7de0f05d907543d - Path: /wp/wp-content/plugins
Path of Installation:
http://www.mysteria30000.de/wp -> Wordpress
http://www.mysteria3000.de/forum --> bbPress
Greetings
Markus
Ok.. I'm not 100% on this, but it seems the cookie hashing algorithm changed in WP2.8 .
In WP2.7, in wp-includes/pluggable.php (line 512)
if ( $expired < time() ) {
do_action('auth_cookie_expired', $cookie_elements);
return false;
}
$key = wp_hash($username . '|' . $expiration, $scheme);
$hash = hash_hmac('md5', $username . '|' . $expiration, $key);
and in 2.8:
// Quick check to see if an honest cookie has expired
if ( $expired < time() ) {
do_action('auth_cookie_expired', $cookie_elements);
return false;
}
$user = get_userdatabylogin($username);
if ( ! $user ) {
do_action('auth_cookie_bad_username', $cookie_elements);
return false;
}
$pass_frag = substr($user->user_pass, 8, 4);
$key = wp_hash($username . $pass_frag . '|' . $expiration, $scheme);
$hash = hash_hmac('md5', $username . '|' . $expiration, $key);
So, in 2.8 the hash is salted with 4 character's of the USer's password. The "freshly_baked_cookies" plugin hasn't been upgraded to match this change, so it always fails to match the hashed cookies.
Unfortunateyl,the get_userdatabylogin function doesn't seem to exist in bbpress.....
It's the same problem that I encountered with 1.0-alpha-5... So it seams that all version before RC2 won't work with the 2.8...
johnhiler
Member
Ah yah Vizworld, I think you nailed it.
I took a look at ck's original plugin and it mentions support for WordPress 2.8 (as of 3/13/09):
http://bbpress.org/plugins/topic/freshly-baked-cookies/
But this post (from 4/3/2009) on ck's blog points out that WordPress 2.8 changed their login model:
http://ckon.wordpress.com/2009/04/03/wordpress-28-might-break-login-compatibility-again/
Sounds like WordPress may have changed it after the Freshly Baked Cookies plugin was released, breaking the FBC plugin?
Ok, I fixed it.. Kinda.. It's a nasty fix, but it _does_ work (I'm using it on http://www.Vizworld.com now).
A quick cliffnotes version:
Took 2 main changes.. a) I had to update the validate_auth function in the _freshly_Baked_cookies plugin to make it work with the new password-including authentication. b) I had to modify the bb-include/pluggable.php to use the new algorithms for salting & auth (wp_salt and wp_auth). The ones that ship with bbpress don't pass a Schema around, and apparently it's important now.
If you want the two files, you can download them from http://www.yeraze.com/bbpress-wp2.8-fbc_fix.tgz . i really hope _ck_ can take a look at this and see if it can all be encapsulated within the fbc plugin.. As it is now, soon as I upgrade bbpress I'll lose it again.
Hi Vizworld,
thanks for your fix - I will test it soon - after a little "distance" from my computer. :)
Today - it's to sunny ... so i must go to the mountains. :)
Hi again,
the code doesn't work 100% in my installation.
After the Login in Wordpress - my testuser is shown as "logged", but I can't go to the Administration. :( The System doesn't redirect me. At the same time my testuser ist shown as "logged in" in bbPress and there I can go to the admin.
When I test the login from bbPress first nothing seems to happen. I'm not logged in in both bbPress and Wordpress.
hmpf ... So ... I'm going to test tomorrow again.
_ck_
Moderator
I predicted this problem at the start of April (and they argued that I was wrong).
http://ckon.wordpress.com/2009/04/03/wordpress-28-might-break-login-compatibility-again/
WP developers simply do not give a darn anymore about backwards compatibility, they just want to do whatever they want to do. Personally I'm getting really tired of their attitude.
The cookie change took me by surprise too and is a bit of a pain in the neck generally.
After the Update to bbPress Version 1.0-rc-3 my problems are gone. I think everyone should test there used plugins, backup and then test the update. Can't wait for bbPress 1. :)
http://bbpress.org/forums/topic/cookie-integration-problem-wp28-bb-10-rc-2
boone-g
Member
I'm very glad to have found this discussion - after upgrading from WPMU 2.7.something to 2.8.4, the cookie swap stopped working, and I couldn't find a good explanation anywhere until I found this thread. Upgrading from bbPress 1.0a6 to 1.0.2 fixed everything.
Thanks very much to the developers for playing catchup to WP's cookie shenanigans.
You must log in to post.
