login redirect - cb checks against livesite

I meant to put this in the CB -> general discussion area but became frustrated when the code post filter wouldn't allow any posts and gave no feedback to explain why. I had no idea why the post would not post!

CB 1.8.1, Joomla 1.5.26


This long base 64 login redirect thread tried to solve the CB login redirect problem many users have. Reference to this thread: www.joomlapolis.com/forum/112-cb-122-general-discussion/126563-base64-login-redirect-not-working?limit=6&start=30

I think I have found one situation in which this is a real problem.

** Edited - this is incorrect, read later in the thread **
If a site has SSL for admin only, JURI::base() returns an https:// address. This means the checking on the return value in the login function may fail. See com_comprofiler/comprofiler.php around line 1246.

The $return variable may be populated with a http:// address but $_CB_framework->getCfg( 'live_site' ) may be populated with a https:// address. In this case, the validation fails, $return is set to '' and the user is always returned to the homepage whenever they login.

Basically, there needs to be a check to see if $_CB_framework->getCfg( 'live_site' ) should have http or https which is how I have chosen to solve this.

We don't check live_site, it's directly pulled from Joomla using Joomla API. You are supposed to leave it blank within configuration.php unless you absolutely know what you're doing and what it's used for. If blank as it should Joomla will always return the proper scheme (http or https, etc.. as needed). Extensions instructing you to configure it should be ignored.

You have misunderstood and jumped to a conclusion. I had also not pinned the problem down, which I have now.

I do not use live_site. In the txt attachment earlier I reference the code in comprofiler.php where CB calls the CB framework ->getCfg('live_site'). This uses the Joomla API, yes, I know, hence the discussion of JURI::base(). I carried on the naming that CB has used: 'live_site'.

In fact getCfg('live_site') (the Joomla API) is generating the correct https:// address but CB isn't checking it properly. Let me explain further.

I use mod_cblogin to login via https:// but then, in general, redirect back to http:// as the whole site doesn't need to be encrypted. This means that a the time the return address is checked, CB is logging the user in via https://. Thus the return address can be http:// but CB_framework->getCfg('live_site') can be https://.

CB doesn't check this when testing for the redirect, it just test the redirect address against CB_framework->getCfg('live_site').

So, without my modification, if I login from a page via https:// I get redirected to the homepage and if I echo out the return value and CB_framework->getCfg('live_site') they are as below:

echo CB $live_site: https /www.mysite.com
echo return: http /www.mysite.com/news/latest

if I login from a page via http:// I get properly redirected to the originating page and if I echo out the return value and CB_framework->getCfg('live_site') they are as below:

echo CB $live_site: http /www.mysite.com
echo return: http /www.mysite.com/news/latest

Now do you see?

Login from HTTPS to HTTP doesn't work, this is intentionally not fixed. It's considered a security issue doing a switch back. Once in HTTPS it's best to stay in HTTPS. Switching back often causes browsers to complain.

I've just tested login via HTTPS and it seams to be working perfectly fine. I've also inspected the URLs in the FORM before and after (logged out) and is displaying fine. Sorry, I'm not sure what your issue is exactly and it's entirely possible you've 3rd party SEF or an htaccess SEF rule that's rewriting the URL.

CB 1.8.1, Joomla 1.5.26
No 3rd party SEF.
mod_cblogin for all logins

Login occurs perfectly but setting in mod_cblogin has several options for https:

HTTPS (encrypted) login, register and lost password
Options: same as page (default)
use https for posting then same
use https (encrypted) for login and after login

I use option 2 as I do not need the entire site https.


Case (unmodified CB or Joomla):

user browses to: http /www.mysite.com/news/latest

user login via mod_cblogin

mod_cblogin sends post to https /www.mysite.com/index.php?option=com_comprofiler&task=login

user is logged in and then redirected to...

https /www.mysite.com


Case (modified CB):

user browses to: http /www.mysite.com/news/latest

user login via mod_cblogin

mod_cblogin sends post to https /www.mysite.com/index.php?option=com_comprofiler&task=login

user is logged in and then redirected to...

http /www.mysite.com/news/latest

"use https for posting then same" intentionally does not work. It's a bug we opted to simply not fix as it'd cause too many potential issues. HTTPS switch-over back to HTTP is too erroneous and often throws browser warnings. Especially in IE, although may not be the case anymore at the time we discussed this. With that said you're welcome to make changes to the module as needed. We'll need to discuss internally if we want to fix this (have already discussed not to previously) or remove the option to avoid confusion (we kept it to prevent the module parameters from potentially breaking on existing sites).