I meant to put this in the CB -> general discussion area but became frustrated when the code post filter wouldn't allow any posts and gave no feedback to explain why. I had no idea why the post would not post!

CB 1.8.1, Joomla 1.5.26


This long base 64 login redirect thread tried to solve the CB login redirect problem many users have. Reference to this thread: www.joomlapolis.com/forum/112-cb-122-general-discussion/126563-base64-login-redirect-not-working?limit=6&start=30

I think I have found one situation in which this is a real problem.

** Edited - this is incorrect, read later in the thread **
If a site has SSL for admin only, JURI::base() returns an https:// address. This means the checking on the return value in the login function may fail. See com_comprofiler/comprofiler.php around line 1246.

The $return variable may be populated with a http:// address but $_CB_framework->getCfg( 'live_site' ) may be populated with a https:// address. In this case, the validation fails, $return is set to '' and the user is always returned to the homepage whenever they login.

Basically, there needs to be a check to see if $_CB_framework->getCfg( 'live_site' ) should have http or https which is how I have chosen to solve this.

You have misunderstood and jumped to a conclusion. I had also not pinned the problem down, which I have now.

I do not use live_site. In the txt attachment earlier I reference the code in comprofiler.php where CB calls the CB framework ->getCfg('live_site'). This uses the Joomla API, yes, I know, hence the discussion of JURI::base(). I carried on the naming that CB has used: 'live_site'.

In fact getCfg('live_site') (the Joomla API) is generating the correct https:// address but CB isn't checking it properly. Let me explain further.

I use mod_cblogin to login via https:// but then, in general, redirect back to http:// as the whole site doesn't need to be encrypted. This means that a the time the return address is checked, CB is logging the user in via https://. Thus the return address can be http:// but CB_framework->getCfg('live_site') can be https://.

CB doesn't check this when testing for the redirect, it just test the redirect address against CB_framework->getCfg('live_site').

So, without my modification, if I login from a page via https:// I get redirected to the homepage and if I echo out the return value and CB_framework->getCfg('live_site') they are as below:

echo CB $live_site: https ://www.mysite.com
echo return: http ://www.mysite.com/news/latest

if I login from a page via http:// I get properly redirected to the originating page and if I echo out the return value and CB_framework->getCfg('live_site') they are as below:

echo CB $live_site: http ://www.mysite.com
echo return: http ://www.mysite.com/news/latest

Now do you see?

CB 1.8.1, Joomla 1.5.26
No 3rd party SEF.
mod_cblogin for all logins

Login occurs perfectly but setting in mod_cblogin has several options for https:

HTTPS (encrypted) login, register and lost password
Options: same as page (default)
use https for posting then same
use https (encrypted) for login and after login

I use option 2 as I do not need the entire site https.


Case (unmodified CB or Joomla):

user browses to: http ://www.mysite.com/news/latest

user login via mod_cblogin

mod_cblogin sends post to https ://www.mysite.com/index.php?option=com_comprofiler&task=login

user is logged in and then redirected to...

https ://www.mysite.com


Case (modified CB):

user browses to: http ://www.mysite.com/news/latest

user login via mod_cblogin

mod_cblogin sends post to https ://www.mysite.com/index.php?option=com_comprofiler&task=login

user is logged in and then redirected to...

http ://www.mysite.com/news/latest