Installation Authentication Issue (Step 1)

did you try it with different browsers? IE, FF, ... ? and if it works with another browser, we need to know with which you had problems.

I tried it with FF 1.5B. I tried cycling the permissions on the login.txt file. I looked at the class code for authenticatrion, and it seemed like it was checking for the existance of the login.txt file in my "/home2/wfowlkes/www/gallery" directory (it states that on the authentication web page with the random numbers) when I know my working directory (when I SSH) is "/home/wfowlkes/www/gallery". However, if I were to change to the "/home2..." directory while I SSH in, I can, and it is like a replication of that directory or a "redirect". But I can not ftp nor sftp to any "/home2" directory - just my "/home..." directories.

I have listed some PHP info below - do not know if it helps, and it is a lot, but I had been using PHP4 and Gallery 1 since before it was beta, and wasdying for G2 to be released finally so I could upgrade.

I moved from PHP4 to this version of PHP, and G1 broke. So at the moment, al 2GB of my photo gallery are down.

Any thoughts, please?

PHP Info:

Build Date Aug 21 2005 22:09:25
Configure Command './configure' '--with-mysql' '--enable-track-vars' '--with-xml' '--enable-memory-limit=yes' '--enable-bcmath' '--enable-calendar' '--with-gd' '--enable-gd-native-tt' '--enable-gd-imgstrttf' '--with-jpeg-dir=/usr/local' '--with-png-dir=/usr/local' '--with-zlib-dir=/usr/include' '--with-freetype-dir=/usr/lib' '--with-gdbm=/usr/include' '--enable-trans-sid' '--with-imap' '--with-imap-ssl' '--with-gettext' '--enable-sockets' '--with-mcrypt' '--enable-xslt' '--with-xslt-sablot' '--with-sablot-js' '--enable-sablot-errors-descriptive' '--with-xmlrpc' '--with-dom' '--with-ming' '--with-curl' '--enable-ftp' '--with-kerberos' '--with-openssl' '--with-iconv' '--with-pear' '--enable-exif' '--enable-force-cgi-redirect'
Server API CGI
Virtual Directory Support disabled
Configuration File (php.ini) Path /usr/local/lib/php.ini
PHP API 20041225
PHP Extension 20050617
Zend Extension 220050617
Debug Build no
Thread Safety disabled
Zend Memory Manager enabled
IPv6 Support enabled
Registered PHP Streams php, file, http, ftp, compress.zlib, https, ftps
Registered Stream Socket Transports tcp, udp, unix, udg, ssl, sslv3, sslv2, tls
Registered Stream Filters string.rot13, string.toupper, string.tolower, string.strip_tags, convert.*, convert.iconv.*, zlib.*

PHP Core Info:

allow_call_time_pass_reference On On
allow_url_fopen On On
always_populate_raw_post_data Off Off
arg_separator.input & &
arg_separator.output & &
asp_tags On On
auto_append_file no value no value
auto_globals_jit On On
auto_prepend_file no value no value
browscap /etc/browscap.ini /etc/browscap.ini
default_charset no value no value
default_mimetype text/html text/html
define_syslog_variables Off Off
disable_classes no value no value
disable_functions no value no value
display_errors On On
display_startup_errors Off Off
doc_root no value no value
docref_ext no value no value
docref_root no value no value
enable_dl On On
error_append_string no value no value
error_log no value no value
error_prepend_string no value no value
error_reporting 2039 2039
expose_php On On
extension_dir ./ ./
file_uploads On On
highlight.bg #FFFFFF #FFFFFF
highlight.comment #FF8000 #FF8000
highlight.default #0000BB #0000BB
highlight.html #000000 #000000
highlight.keyword #007700 #007700
highlight.string #DD0000 #DD0000
html_errors On On
ignore_repeated_errors Off Off
ignore_repeated_source Off Off
ignore_user_abort Off Off
implicit_flush Off Off
include_path .:/usr/local/share/pear:/usr/local/lib/php .:/usr/local/share/pear:/usr/local/lib/php
log_errors Off Off
log_errors_max_len 1024 1024
magic_quotes_gpc On On
magic_quotes_runtime Off Off
magic_quotes_sybase Off Off
mail.force_extra_parameters no value no value
max_execution_time 1200 1200
max_input_time -1 -1
memory_limit 32M 32M
open_basedir no value no value
output_buffering no value no value
output_handler no value no value
post_max_size 75M 75M
precision 14 14
realpath_cache_size 16K 16K
realpath_cache_ttl 120 120
register_argc_argv On On
register_globals On On
register_long_arrays On On
report_memleaks On On
report_zend_debug On On
safe_mode Off Off
safe_mode_exec_dir no value no value
safe_mode_gid Off Off
safe_mode_include_dir no value no value
sendmail_from

sendmail_path /usr/sbin/sendmail -t -i /usr/sbin/sendmail -t -i
serialize_precision 100 100
short_open_tag On On
SMTP localhost localhost
smtp_port 25 25
sql.safe_mode Off Off
track_errors Off Off
unserialize_callback_func no value no value
upload_max_filesize 75M 75M
upload_tmp_dir /tmp /tmp
user_dir no value no value
variables_order EGPCS EGPCS
xmlrpc_error_number 0 0
xmlrpc_errors Off Off
y2k_compliance Off Off
zend.ze1_compatibility_mode Off Off

PHP Session Info:

session.auto_start Off Off
session.bug_compat_42 On On
session.bug_compat_warn On On
session.cache_expire 180 180
session.cache_limiter nocache nocache
session.cookie_domain no value no value
session.cookie_lifetime 0 0
session.cookie_path / /
session.cookie_secure Off Off
session.entropy_file no value no value
session.entropy_length 0 0
session.gc_divisor 100 100
session.gc_maxlifetime 1440 1440
session.gc_probability 1 1
session.hash_bits_per_character 4 4
session.hash_function 0 0
session.name PHPSESSID PHPSESSID
session.referer_check no value no value
session.save_handler files files
session.save_path /tmp /tmp
session.serialize_handler php php
session.use_cookies On On
session.use_only_cookies Off Off
session.use_trans_sid 1 1

Valandril probably that's a symlink or a webserver alias.
are you the admin of this webserver?

this is a weird setup. and if it actually is a symlink, then you should find the login.txt that you created in /home/... also in /home2/...
only something like a open_basedir restriction or something similar could cause that it thinks that the login.txt doesn't exist.

Yes, it shows up in /home and /home2. I can see the file in both directories. When I put it in one it is also shown in the other, but I do not see it as a symlink...

i can't really help you there.
can you ask your admin what the issue might be?

and what mechanism they are using to link /home to /home2/ ? symlinks are apache alias?

you'll have problems with G2 because we use dirname(__FILE__) everywhere to determine the current path and include other files. and it will always be something with /home2/ in your case. and it always does a file_exists.

please delete the login file again, you should get the message that there is no login file. (wanna make sure you create login.txt in the right directory). sorry, you never know

then please try again.

does when you hit refresh, does it show new random numbers every time? it shouldn't.

I am using MS IE v6.0.2900.2180.xpsp_sp2_gdr.050301-1519... Dont know if that helps any...

in prior posts, you said you tried it also with other browsers too. so it's most probably a server issue and not a client side issue.

if you PM me the url and FTP information, i could try my luck tomorrow.

these are the values of the session related php.ini variables from my php.ini. all other session variables are commented out in my php ini.
these values are not a recommendation or requirement for g2, but they may help you.

session.save_handler = files
session.use_cookies = 1
session.name = PHPSESSID
session.auto_start = 0
session.cookie_lifetime = 0
session.cookie_path = /
session.cookie_domain =
session.serialize_handler = php
session.gc_probability = 1
session.gc_divisor = 100
session.gc_maxlifetime = 1440
session.bug_compat_42 = 1
session.bug_compat_warn = 1
session.referer_check =
session.entropy_length = 0
session.entropy_file =
session.cache_limiter = nocache
session.cache_expire = 180
session.use_trans_sid = 0

you're not the only one to have problems with the installer authentication. but you're the only one who can't even authenticate. a few other users lose their session or something like that in other steps and then fall back to step 2.

the other two being:
http://gallery.menalto.com/node/36734 and
http://gallery.menalto.com/node/36698

i haven't yet found a correlation in your setups / configs that could have to do with it, maybe you have more luck...

the thing is, if the authentication doesn't work, you probably lose session data too, session data that is required to finish the installer successfully.
without debugging your installation, i don't really have a constructive idea.

php 5.1.0 RC3 has known bugs which make it not work with G2.
maybe your 5.1.0 RC1 is also bugged.

i'd try a less-bleeding-edge version of PHP, either php 5.0.5 or php 4.3.12 or 4.4.0 .

ah, cool

another user tried PHP 5.1.0 RC3 and managed to install it. had a mod_rewrite / php issue though and had to report it. but at least this problem you had there should be solved in the final version of php 5.1.0.

Hi again

Sorry forgot to tell you that I have set FF and Mozilla to ask me if some site tries to set a cookie and they havn't warned me.
And I have know Idea where I role back my php versions I work on a standard laptop with XP as operating system.

Regards

thanks for letting us know!

it's storing the auth key in the session.
see install/index.php end of file, -> serialize ...
it's using PHP's session mechanism (thus storing the session as a file in the session save dir, see phpinfo for the path).

it's cool that you're trying to debug it. if you succeed, you could help a lot other users too (maybe 1% of all g2 users have this problem, probably less).

when i browse to install, step 1 (auth step. it shows me the auth key: b261f98bc34b0636d64b8cfb4c49557b
and it sends me a cookie PHPSESSID with content/value: 41baa6bd5359c8481e2063eea9098fca

i check in phpinfo my session save_path, it is /tmp.
in /tmp, i do ls -latr and see a file:
sess_41baa6bd5359c8481e2063eea9098fca

the files contents is the serialized data:

install_path|s:52:"/var/www/localhost/htdocs/gallery2/install/index.php";
language|s:5:"en_US";
install_steps|s:1663:"a:12:
{i:0;O:11:"welcomestep":4:{s:11:"_stepNumber";i:0;s:11:"_isComplete";b:0;s:10:"_isInError";b:0;s:11:"_isLastStep";b:0;}
i:1;O:16:"authenticatestep":6:{s:11:"_stepNumber";i:1;s:11:"_isComplete";b:0;s:10:"_isInError";b:0;s:11:"_isLastStep";b:0;s:10:"_uniqueKey";s:32:"b261f98bc34b0636d64b8cfb4c49557b";s:10:"_firstTime";b:0;}
i:2;O:16:"systemchecksstep":4:{s:11:"_stepNumber";i:2;s:11:"_isComplete";b:0;s:10:"_isInError";b:0;s:11:"_isLastStep";b:0;}
i:3;O:13:"multisitestep":6:{s:11:"_stepNumber";i:3;s:11:"_isComplete";b:0;s:10:"_isInError";b:0;s:11:"_isLastStep";b:0;s:12:"_isMultisite";N;s:11:"_configPath";N;}
i:4;O:16:"storagesetupstep":4:{s:11:"_stepNumber";i:4;s:11:"_isComplete";b:0;s:10:"_isInError";b:0;s:11:"_isLastStep";b:0;}
i:5;O:17:"databasesetupstep":4:{s:11:"_stepNumber";i:5;s:11:"_isComplete";b:0;s:10:"_isInError";b:0;s:11:"_isLastStep";b:0;}
i:6;O:18:"adminusersetupstep":5:{s:11:"_stepNumber";i:6;s:11:"_isComplete";b:0;s:10:"_isInError";b:0;s:11:"_isLastStep";b:0;s:20:"_hasBeenLoadedBefore";N;}
i:7;O:20:"createconfigfilestep":5:{s:11:"_stepNumber";i:7;s:11:"_isComplete";b:0;s:10:"_isInError";b:0;s:11:"_isLastStep";b:0;s:10:"_firstTime";b:1;}
i:8;O:21:"installcoremodulestep":4:{s:11:"_stepNumber";i:8;s:11:"_isComplete";b:0;s:10:"_isInError";b:0;s:11:"_isLastStep";b:0;}
i:9;O:23:"installothermodulesstep":4:{s:11:"_stepNumber";i:9;s:11:"_isComplete";b:0;s:10:"_isInError";b:0;s:11:"_isLastStep";b:0;}
i:10;O:10:"securestep":4:{s:11:"_stepNumber";i:10;s:11:"_isComplete";b:0;s:10:"_isInError";b:0;s:11:"_isLastStep";b:0;}
i:11;O:12:"finishedstep":4:{s:11:"_stepNumber";i:11;s:11:"_isComplete";b:0;s:10:"_isInError";b:0;s:11:"_isLastStep";b:1;}}";

i added newlines after each step, you see the auth key in the auth step.

now your job as user is to create a file called login.txt in your gallery2/ directoy, with a single line: b261f98bc34b0636d64b8cfb4c49557b

Questions:
1. don't you get such a session file in your php session save path?
2. what else differes?

new enlightment:

it seems that the functions in AuthenticateStep.class cannot assign the right value for

$this->_uniqueKey

$fileAuth is always correct

it seems that the class generates the uniquekey everytime it is run , without asking the sessionfile for its right value

to debug this i entered a simple

after line 82 in AuthenticateStep.class

it shows that the final flow if ($fileAuth == $this->_uniqueKey), that should grant access takes the uniqueKey from the newly generated random-hash instead of loading it from the apache-sessionfile

since i think the code is welldone i suggest a php.ini problem .. but i cannot figure it out yet ..

so far

trueshanti

just to recapitulate:
1. for you, the cookie was never accepted by your browser / never sent back to the server because the cookie domain was wrong
2. the logical consequence is that g2 generates a new auth key for each refresh of the page in your case -> explains new $this->_uniqueKey for each request
3. what i don't understand is your statement "$fileAuth is always correct"
4. and i also don't understand "on my macox-laptop i dont have this issue , though the auth-step is never secure". can you verify that when you delete your cookies on your laptop and visit the installer again, that you don't need to create login.txt etc to advance to the steps 3 etc?

the installer works even when you don't accept cookies / if cookies don't work.
i just tested it again with opera / cookies disabled.
you just shouldn't refresh the auth step page until you created that login.txt

oh, i finally can reproduce lost session issues in the installer. it happens in an arbitrary step if you don't use cookies.
working on that now...

1. true

2. true

3. i mean there was no problem reading the key from login.txt

4. to resummarize: i have no cookie-domain-settings on my laptop

"never secure" i have to take back , for i thought the auth-mechanism should always start wenn install is performed .. the auth-step was already finished thats why i am asked for it again on my laptop, and the Auth successes whenever i rerun the installations-steps again .. it seems that the sessions dont expire on my laptop-installation. i have to fix this

thanks for support

- session.cookie_domain = blank is fine. in that case the browser just defaults to the current path (e.g. /install/)
- you've got the latest snapshot, that's good

if you fail during the authentication step, i can't help you. that's just weird.
try:
- copy the auth string in your browser to a text file, do not use the login.txt download option
- create a text file, paste the auth key in it, save the file as login.txt and put it to the gallery2 dir
- click authenticate me

what i fixed was cookieless browsing / installing

they should rather compare their php 5.0.3 and php 5.0.5 compile options and php.ini settings.

installed the latest nightly build but still can't solve the problem.. following is my php setup..

http://www.shortaways.com/phpinfo.php

yclim

three questions:

1. i want to make sure you really have the latest version: please open install/index.php
please look at the first lines:

<?php
/*
 * ATTENTION:
 *
 * If you're seeing this in your browser, and are trying to install Gallery,
 * you either do not have PHP installed, or if it is installed, it is not
 * properly enabled. Please visit the following page for assistance:
 *
 *    http://gallery.sourceforge.net/
 *
 * ----------------------------------------------------------------------------
 *
 * $Id: index.php,v 1.65 2005/11/27 09:13:09 andy_st Exp $

is it also 1.65 ... for you there?

2. in the authentication step, if you open login.txt does it show the same auth key as the one you see in the browser?
3. when you click authenticate me, does the key change everytime? it should stay the same