X3Photo Gallery Forums

Hard to diagnose without any link ...

# After login-attempt, does the page actually state "Please check your username or password.", or does it just return the original login page?

# Do you have the Suhosin extension installed on server? This could cause trouble.

# Do you have mcrypt extension? This is required.

If you have uploaded the original X3 files in tact without any editing, the above are the only issues I have ever experienced which could prevent login from working.

theflyingman wrote:# After the login attempt the original login page is displayed.
# Suhosin is installed on the server based on the phpinfo.

Almost 100% sure this is related to Suhosin. Suhosin was sometimes installed with older PHP versions, when security in the PHP version itself was not sufficient.

theflyingman wrote:- http://test.lebl.cz
- http://test.theflyingman.cz

Looking at the check pages, the servers seem differently setup, and I assume the first one has Suhosin, while the other doesn't.

theflyingman wrote:I can provide you with FTP access if you would like to investigate it further.

If you could offer FTP to both the websites, I could state 100% for sure what is the issue.

Suhosin
Unfortunately, if the issue is Suhosin, there is little we can do to fix it. Suhosin is a custom security extension with 100's of custom settings, and one of them is simply blocking the login. X3 panel uses a standard encrypted user/password check on login, and we can't patch it to work with suhosin, although it's likely you could change suhosin settings to allow login somehow. My recommendation is to update to a newer PHP version (5.5+ or even 7.0), and disable Suhosin.

I installed diagnostics from the latest release on both websites:
http://test.lebl.cz/?diagnostics
http://test.theflyingman.cz/?diagnostics

Basically, both servers have suhosin, which definitely is the issue. How you got one of them working and not the other, I don't know, but they might as well have different suhosin-configurations. Also, strange servers ... They are "similar", but "different" servers setups ... They have different PHP versions, one has Debian (the other likely linux), they have different Apache versions, different PHP memory limits, and one has Mod Headers disabled. To be honest, this doesn't seem to be part of a stable fundament that a professional host would be offering, with mixed, outdated configs that vary across domains.

Is this some private/custom hosting setup? Unless you manage to figure out how you managed to get one login working, which is likely related to suhosin config, then there is little more we can do.

PS! I actually fixed mod_rewrite to work on both websites by adding "RewriteBase /" in the .htaccess file for both websites.

theflyingman wrote:Mod Rewrite shows up in the check, but I'll look into that later today when I get back from the office, I should do something more productive now .

Mod Rewrite seems to be working fine. Some other Apache modules are "undetectable", but that doesn't mean they are not working. In fact, I can see that mod_deflate is working fine also, because server output is gzipped. Only mod_rewrite is strictly required anyway ... this is "extended diagnostics".

Your server seems 100% ready for X3 now, although the open_basedir restriction may prevent X3 from being able to purge outdated PHP cache files, which in itself is not a critical problem.

theflyingman wrote:Over the last week I've been migrating from X2 to X3 and yesterday I've finally launched X3 in production at http://photo.lebl.cz.

Looks great! That Titillium Web font sure looks sweet also ...