Alohaphp Posted November 26, 2012 Share Posted November 26, 2012 I would like to ask for some help. It is really basic stuff but it seams i can't figure that part out. 1) I have a php application, where after login user gets to back-end area. 2) The problem is i can login on my localhost and i will see the back-end area, but after setting up staging server i can't get to that area.... error says "User ID or Password you entered is not correct". What it could be? Any help would be much appreciated. Quote Link to comment Share on other sites More sharing options...
Jessica Posted November 26, 2012 Share Posted November 26, 2012 There is a 100% change that the error you're seeing is generated BY the application. Find the code that spits it out and you'll find the problem. Did you write this application? Quote Link to comment Share on other sites More sharing options...
Backslider Posted November 26, 2012 Share Posted November 26, 2012 At least the error you are seeing is a good one - I agree with Jessica that its output by the application itself. I cringe at the number of applications that will give a message like: "Your password is incorrect" - this immediately tells a hacker that they have a valid user name. It could be a problem with how the password is salted - may differ between your localhost and staging server, or a case sensitivity issue. Quote Link to comment Share on other sites More sharing options...
Jessica Posted November 26, 2012 Share Posted November 26, 2012 At least the error you are seeing is a good one - I agree with Jessica that its output by the application itself. I cringe at the number of applications that will give a message like: "Your password is incorrect" - this immediately tells a hacker that they have a valid user name. It could be a problem with how the password is salted - may differ between your localhost and staging server, or a case sensitivity issue. And I hate it when a site doesn't tell me that the username I'm trying to login as or the email I tried to use to reset my password isn't valid, and I'm just wasting my time when I'm a real user. The line has to be drawn somewhere. Quote Link to comment Share on other sites More sharing options...
Backslider Posted November 26, 2012 Share Posted November 26, 2012 And I hate it when a site doesn't tell me that the username I'm trying to login as or the email I tried to use to reset my password isn't valid, and I'm just wasting my time when I'm a real user. The line has to be drawn somewhere. I think its ok to show that the email is incorrect for password/ username reset/retrieval - I have never seen otherwise. I work almost exclusively on eCommerce systems, so if you cannot remember your username or password you can retrieve them with a valid email address - the login page will NOT tell you and this is as it should be for better security. Quote Link to comment Share on other sites More sharing options...
Jessica Posted November 26, 2012 Share Posted November 26, 2012 I've seen systems where when I try to retrieve my username, it accepts an email that is not in their system and tells me to check my email. Or plenty of systems that don't even have forgot username, only password. So if you aren't telling me that my email or username is non-existent, I'm checking half a dozen email addresses for a reset email that will never come. And of course these sites never have tech support you can access without logging in,. Quote Link to comment Share on other sites More sharing options...
Alohaphp Posted November 27, 2012 Author Share Posted November 27, 2012 There is a 100% change that the error you're seeing is generated BY the application. Find the code that spits it out and you'll find the problem. Did you write this application? Nope i haven't wrote it. It's somebody else's app that got zero comments and none of the documentation. I only see the website where it's implemented and i have db records for users and administrators and moderators. To make a long story short i can login with email and password on real site, then i can login with the same info on my localhost, but all of a sudden when i created staging server....i'm getting an error of course generated by that app. So the logical question would be, how i can debug that app? There is no any errors i can see in log files. Thank you for help. Quote Link to comment Share on other sites More sharing options...
Alohaphp Posted November 27, 2012 Author Share Posted November 27, 2012 At least the error you are seeing is a good one - I agree with Jessica that its output by the application itself. I cringe at the number of applications that will give a message like: "Your password is incorrect" - this immediately tells a hacker that they have a valid user name. It could be a problem with how the password is salted - may differ between your localhost and staging server, or a case sensitivity issue. Thank you for your thought! Will try to look more deeply. Quote Link to comment Share on other sites More sharing options...
Jessica Posted November 27, 2012 Share Posted November 27, 2012 Well, you get what you pay for. And if you paid for this app, you got a lesson. Hire a freelancer or learn PHP. Quote Link to comment Share on other sites More sharing options...
Alohaphp Posted November 27, 2012 Author Share Posted November 27, 2012 Well, you get what you pay for. And if you paid for this app, you got a lesson. Hire a freelancer or learn PHP. I defiantly want to learn php, but it's not going happen overnight. Can i use your help? Quote Link to comment Share on other sites More sharing options...
Jessica Posted November 27, 2012 Share Posted November 27, 2012 There is no way you're going to get someone to help you debug your server and non-documented buggy app. For free. Quote Link to comment Share on other sites More sharing options...
DavidAM Posted November 27, 2012 Share Posted November 27, 2012 ... i can login with email and password on real site, ... i can login with the same info on my localhost, but all of a sudden when i created staging server....i'm getting an error of course generated by that app. Obviously, the staging server is not setup "properly" for the app. Did you create a database for it? Did you put the data in the database? Did you adjust the database credentials? Is the database server available to PHP? Does the Database Username in the app have proper permissions? Is the filesystem setup properly? Does PHP and Apache have the appropriate permissions? Quote Link to comment Share on other sites More sharing options...
PFMaBiSmAd Posted November 27, 2012 Share Posted November 27, 2012 error says "User ID or Password you entered is not correct". You would start by determining why the code is producing that message. Find out where and then why the entered user id/password don't match wherever and whatever they are being compared with. Quote Link to comment Share on other sites More sharing options...
Alohaphp Posted December 10, 2012 Author Share Posted December 10, 2012 You would start by determining why the code is producing that message. Find out where and then why the entered user id/password don't match wherever and whatever they are being compared with. Obviously, the staging server is not setup "properly" for the app. Did you create a database for it? Did you put the data in the database? Did you adjust the database credentials? Is the database server available to PHP? Does the Database Username in the app have proper permissions? Is the filesystem setup properly? Does PHP and Apache have the appropriate permissions? There is no way you're going to get someone to help you debug your server and non-documented buggy app. For free. Thank you for your help! So here is the next episode :-) The reason why i could't get any response was because in database table - users is lowecase and in all php files it was - Users (capitalize) Couple files were fixed, but here is what i don't understand. Same script working fine on some other linux server. Do i have any smarter way of resolving that issue rather manually change all capitalized Users to lowercase one? What it could be? You opinions are very appreciated! Thanks. Quote Link to comment Share on other sites More sharing options...
PFMaBiSmAd Posted December 10, 2012 Share Posted December 10, 2012 See this link - http://dev.mysql.com/doc/refman/5.5/en/identifier-case-sensitivity.html Quote Link to comment Share on other sites More sharing options...
Recommended Posts
Join the conversation
You can post now and register later. If you have an account, sign in now to post with your account.