You know sometimes users cannot send posts in forums, news comments, .. and will receive same error again and again.
This is really annoying for new users.
eg: in newbb they will receive this error constantly:
Quote:
Invalid submission. You could have exceeded session time. Please re-submit or make a backup of your post and login to resubmit if necessary.
I noticed this issue will occur mainly when user use remember me and the reason is in XoopsSecurity class invalid tokens will be checked in an infinite loop until the user logout or somehow the tokens changed.
in xoops255/class/xoopssecurity.php
function validateToken($token = false, $clearIfValid = true, $name = 'XOOPS_TOKEN')
{
global $xoopsLogger;
$token = ($token !== false) ? $token : (isset($_REQUEST[$name . '_REQUEST']) ? $_REQUEST[$name . '_REQUEST'] : '');
if (empty($token) || empty($_SESSION[$name . '_SESSION'])) {
$xoopsLogger->addExtra('Token Validation', 'No valid token found in request/session');
return false;
}
$validFound = false;
$token_data = & $_SESSION[$name . '_SESSION'];
foreach (array_keys($token_data) as $i) {
if ($token === md5($token_data[$i]['id'] . $_SERVER['HTTP_USER_AGENT'] . XOOPS_DB_PREFIX)) {
if ($this->filterToken($token_data[$i])) {
if ($clearIfValid) {
// token should be valid once, so clear it once validated
unset($token_data[$i]);
}
$xoopsLogger->addExtra('Token Validation', 'Valid token found');
$validFound = true;
} else {
$str = 'Valid token expired';
$this->setErrors($str);
$xoopsLogger->addExtra('Token Validation', $str);
}
}
}
if (!$validFound) {
$xoopsLogger->addExtra('Token Validation', 'No valid token found');
}
$this->garbageCollection($name);
return $validFound;
}
i test this function in my huge website and i suggest to clear all tokens in the first time they are considered as invalid.
so i suggest to add this:
if (!$validFound) {
// START add by irmtfan
$this->clearTokens($name);
// END add by irmtfan
$xoopsLogger->addExtra('Token Validation', 'No valid token found');
}
Im not a coder or developer but i see the above will solve the issue.
I need your advices, then we can send it to the bug tracker.
Also this is a functional bug and not a security bug. (but really annoying for users)
IMO because of some other bugs like theme changing issue core team should investigate following parts in xoops core:
- sessions
- tokens
- remember me functionality
