Epesi user lost

jaumealco

Hi,

I need some help about an error that appear in my EPESI users randomly. Sometimes when the users move in the app, the logged user changes to another users from de database, without showing any error message. We have looked on an error_table which saves logi errors, and we see that EPESI returns null when try to get the user connected, and connect to another randomly.

Acl::get_user()==null

Could someone help me?
Has someone the same error?

Thanks

Jaume

ajb

Acl::get_user is related to session. Session id is stored in cookies - I suppose it occurs on different computers/browsers, so it shouldn't be an issue.
EPESI stores main session key in the database - in table session. In this table EPESI stores user id, session id and expiration date. User id is stored as serialized data in data column. It shouldn't change at random.
If user is inactive and session will expire, then data from user_autologin is used to reinitialize session - if user had selected "keep me logged in".

Please review those tables and try to spot any issues. Especially check is session id in database and in browser's cookie the same.

Where get_user gives null? What's the error report?

Regards,
Adam

jaumealco

Hi Adam,

It's a cookie problem. for example, a connected user X has a PHPSESSID YYYYYYY and an other connected user Z has a PHPSESSID WWWWWWW. Randomly their PHPSESSID changes of user, user X changes his PHPSESSID to WWWWWWW and user Z changes his PHPSESSID to YYYYYYY. It happens mostly with sames users, user Z mostly changes his PHPSESSID with user X. It's possible a limit connected users problem?
In our app there may be connected more than 100 users at same time, it could be a problem?
We dont know why it happens, and also how to reproduce that problem, it always happens randomly.

Any solution idea?

Thanks

Jaume

ajb

Are you able to spot the point where session id changes? Take a look at cookies response?
You can also modify include/session.php file and add some error triggers on issues. At the end of file change
From

session_name(ini_get('session.name'));

session_set_cookie_params(0,EPESI_DIR);

session_start();

session_name(ini_get('session.name'));

session_set_cookie_params(0,EPESI_DIR);

$ret = session_start();

if (!$ret) {

    trigger_error('Session init failed', E_USER_ERROR);

}

if (isset($_COOKIE[ini_get('session.name')]) && $_COOKIE[ini_get('session.name')] !== session_id()) {

    trigger_error('Request session id differs than generated one', E_USER_ERROR);

}

Do users send some links to each other? I hope PHPSESSID is not passed with the URL?
Swap of session ids is strange issue, because it core PHP function that manages session id. Only place where EPESI is used is the store for the session. Standard PHP uses some files in tmp directory, EPESI uses database to save and read SESSION variables.

Regards,
Adam

jaumealco

We are doing test with the code that you send me. Many users receive this message when they log out.



Hide

Type: E_USER_ERROR (256)

Message: mysqlt error: [1064: You have an error in your SQL syntax; check the manual that corresponds to your MariaDB server version for the right syntax to use near '%d LIMIT 1' at line 1] in EXECUTE("SELECT p.mail FROM user_password p WHERE p.user_login_id=%d LIMIT 1") 

File: /home/accpmoco/public_html/libs/adodb/adodb-errorhandler.inc.php

Line=77

error backtrace:

[PHP core called function]

    function called: handle_epesi_error(256, "mysqlt error: [1064: You have an error in your SQL syntax; check the manual that corresponds to your MariaDB server version for the right syntax to use near '%d LIMIT 1' at line 1] in EXECUTE(\"SELECT p.mail FROM user_password p WHERE p.user_login_id=%d LIMIT 1\") ", "/home/accpmoco/public_html/libs/adodb/adodb-errorhandler.inc.php", 77, Array ("mysqlt", "EXECUTE", 1064, "You have an error in your SQL syntax; check the manual that corresponds to your MariaDB server version for the right syntax to use near '%d LIMIT 1' at line 1", "SELECT p.mail FROM user_password p WHERE p.user_login_id=%d LIMIT 1", false, Object (ADODB_mysqlt), "SELECT p.mail FROM user_password p WHERE p.user_login_id=%d LIMIT 1", false, "mysqlt error: [1064: You have an error in your SQL syntax; check the manual that corresponds to your MariaDB server version for the right syntax to use near '%d LIMIT 1' at line 1] in EXECUTE(\"SELECT p.mail FROM user_password p WHERE p.user_login_id=%d LIMIT 1\") "))

File: /home/accpmoco/public_html/libs/adodb/adodb-errorhandler.inc.php

    line 77

    function called: trigger_error("mysqlt error: [1064: You have an error in your SQL syntax; check the manual that corresponds to your MariaDB server version for the right syntax to use near '%d LIMIT 1' at line 1] in EXECUTE(\"SELECT p.mail FROM user_password p WHERE p.user_login_id=%d LIMIT 1\") ", 256)

File: /home/accpmoco/public_html/libs/adodb/adodb.inc.php

    line 1043

    function called: ADODB_Error_Handler("mysqlt", "EXECUTE", 1064, "You have an error in your SQL syntax; check the manual that corresponds to your MariaDB server version for the right syntax to use near '%d LIMIT 1' at line 1", "SELECT p.mail FROM user_password p WHERE p.user_login_id=%d LIMIT 1", false, "Object (ADODB_mysqlt)")

File: /home/accpmoco/public_html/libs/adodb/adodb.inc.php

    line 1018

    function called: _Execute("SELECT p.mail FROM user_password p WHERE p.user_login_id=%d LIMIT 1", false)

File: /home/accpmoco/public_html/libs/adodb/drivers/adodb-mysql.inc.php

    line 497

    function called: Execute("SELECT p.mail FROM user_password p WHERE p.user_login_id=%d LIMIT 1", null)

File: /home/accpmoco/public_html/libs/adodb/drivers/adodb-mysql.inc.php

    line 162

    function called: SelectLimit("SELECT p.mail FROM user_password p WHERE p.user_login_id=%d", 1, -1, null)

[PHP core called function]

    function called: GetOne("SELECT p.mail FROM user_password p WHERE p.user_login_id=%d", null)

File: /home/accpmoco/public_html/include/database.php

    line 480

    function called: call_user_func_array(Array (Object (ADODB_mysqlt), "GetOne"), Array ("SELECT p.mail FROM user_password p WHERE p.user_login_id=%d", null))

File: /home/accpmoco/public_html/modules/Accenture/KanbanTools/KanbanToolsCommon_0.php

    line 445

    function called: GetOne("SELECT p.mail FROM user_password p WHERE p.user_login_id=%d", null)

File: /home/accpmoco/public_html/modules/Accenture/Horas/Horas_0.php

    line 14

    function called: get_usermail()

[PHP core called function]

    function called: body()

File: /home/accpmoco/public_html/include/module.php

    line 793

    function called: call_user_func_array(Array (Object (Accenture_Horas), "body"), Array ())

File: /home/accpmoco/public_html/include/module.php

    line 713

    function called: get_html_of_module(Object (Accenture_Horas), null, null)

File: /home/accpmoco/public_html/modules/Base/Box/Box_0.php

    line 146

    function called: display_module("Object (Accenture_Horas)")

File: /home/accpmoco/public_html/include/epesi.php

    line 213

    function called: body()

File: /home/accpmoco/public_html/include/epesi.php

    line 258

    function called: go(Object (Base_Box))

File: /home/accpmoco/public_html/process.php

    line 32

    function called: process("", "0")

________________________________________

Any idea? We have EPESI since January 2014 and problems begin at August 2014, before that EPESI worked well...

Thanks

Jaume

ajb

You haven't told me, that you've got some custom modules modules/Accenture/KanbanTools
It matters.
I can't help you in such situation. Every module can do everything, even swap user sessions... So it's hard to tell.
You could clone your installation, uninstall all custom modules and test if it's working properly.

jaumealco

Hi,
Custom modules does not affect to users, this modules only get connected users. It's possible to have more than 100 connected users at same time, but in session table, maximum registers that we have seen are 25. I think that every connected user should have one different session to avoid session login problems.

Thanks for replies

Jaume

ajb

There is no strict limit introduced in EPESI. Maybe this will be helpful? http://stackoverflow.com/questions/4274 ... -variables

If you've got some performance drawbacks then you can switch EPESI to use memcached, instead of files to store session data - but this is not session table, so it should have at least so many rows as users logged in.

superori

Hi, when we updated to latest version of EPESI, this error didn't appear anymore, until now.

Strange, the first time that the error with user session appears was 8 months until first installation. Then, we updated the epesi version and this error didn't appear anymore until now, 5 months after update.

The case is that when this error appears, it repeats often. It seems that user session is lost when they enter in our module screen (not everytime, but sometimes it happens).

The first line of our module is trying to get the user mail, calling to another module, and it calls Acl::get_user(). Whe identified that user session changes allways that Acl::get_user() return null.



  public function body(){ // start

		$user_mail = Acc_KanbanToolsCommon::get_usermail();

Acc_KanbanToolsCommon_0.php



function get_usermail($email=null){

		if($email==null){

			if(Acl::get_user()==null){ //<- Allways when this is null, the currentlogin sesion is changed by other user ¿why?

Why is possible that Acl::get_user() is returning null??

ajb

Simple - when user is not logged in it will be null.
1. Browser passes cookie with session ID
2. EPESI recognizes session ID and reads session data from: File / Database / Memcache (configurable in config.php)
3. You're logged in.

I have no idea what's wrong - just make it fail-proof.

Epesi ENS | Epesi Academy | epesi.cloud PaaS | GitHub

Help Me! | Download from SourceForge