Fix: Can't login/register/multiple session_id's

[npeelman]

YaBB SE Version: 1.5.4
PHP Version: 4.3.1
MySQL Version: 3.23.x
Server Platform: Windows
Link to Forum: http://www.suddenimpactfans.com/yabbse

Problem Description:
Well, here is what I found:

If your DNS provider serves you as a framed redirect you must make the following edit in PHP.INI (do not ad port if other than 80 -untested-)...

[session]
session.cookie_domain = xxx.xxx.xxx.xxx

...where xxx.xxx.xxx.xxx is your servers ip address.

And modify (or during install) /yabbse/Settings.php so that all references to your server use your server ip address instead of http://my.domain.com/

specifically (use port if other than 80):

$boardurl = "http://xxx.xxx.xxx.xxx:port/yabbse";
$facesurl = "http://xxx.xxx.xxx.xxx:port/yabbse/YaBBImages/avatars";
$imagesdir = "http://xxx.xxx.xxx.xxx:port/yabbse/YaBBImages";
$ubbcjspath = "http://xxx.xxx.xxx.xxx:port/yabbse/ubbc.js";
$faderpath = "http://xxx.xxx.xxx.xxx:port/yabbse/fader.js";
$helpfile = "http://xxx.xxx.xxx.xxx:port/yabbse/YaBBHelp/index.html";

So far the only thing i've found that I can't do is DELETE a post. I get:

An Error Occured!
Invalid Referer

This could be a easy fix I think...

I have tried using http://my.domain.com in place of ip addresses in both configs but couldn't get it to work.

[[Unknown]]

Whereever you read that, it's incorrect.  Internet Explorer will *NOT* store crossdomain cookies, which is exactly what you are trying to do.

Sorry.  You may wish to just make the domain *fully* redirect to the ip:port.

-[Unknown]

[npeelman]

Whereever you read that, it's incorrect.  Internet Explorer will *NOT* store crossdomain cookies, which is exactly what you are trying to do.

Sorry.  You may wish to just make the domain *fully* redirect to the ip:port.

-[Unknown]

Didn't read it anywhere - found out through hours of trial and error. It appears to work at least from same machine that the server is on as the cookie appears after logging in.

Here is the cookie that is set:

YaBBSE151
a%3A2%3A%7Bi%3A0%3Bs%3A1%3A%221%22%3Bi%3A1%3Bs%3A32%3A%22163af88f680662ee68444064034477fcf%22%3B%7D
xxx.xxx.xxx.xxx/
1024
5761792
29585548
2670657456
29585539
*

 I altered some of the info to scramble it but that's what I find on my system with my server ip in place of the red x's.

 And adding the port to PHP.INI/session.cookie_domain did not work. Will need to test from other machine...

[[Unknown]]

You are going to have session and referer errors this way.  It's inevitable.

-[Unknown]

[npeelman]

You are going to have session and referer errors this way.  It's inevitable.

-[Unknown]

Confirmed working from different computer... only error seems to come from 'DELETE' message.

[Douglas]

npeelman, you might want to listen to [Unknown]'s advice.  He's QUITE versed in stuff like this...

[npeelman]

npeelman, you might want to listen to [Unknown]'s advice.  He's QUITE versed in stuff like this...

Sorry,  I don't mean to come across like i'm ignoring anyone.  Just letting people know what i've found out.  I don't get alot of hits to my site (yet) so i've got nothing to do but play around and see what works and what doesn't... and wait for the 'new' version to see if that solves my problems. What i'd really like to see is the ability to use/not use cookies at the admin level. I'd be happy with just sessions. I'm actually trying to devise a session only system myself (with alittle extra security).

[[Unknown]]

That's not the problem.  The problem is the way it checks the referer.  You should not use redirection or frames with YaBB SE 1.5.4.

SMF, however, has this issue fixed for all I can tell.

-[Unknown]