Support » Plugin: WordPress Persistent Login » Latest version breaks some sites

  • Resolved harryfear

    (@harryfear)


    Hi,

    The latest version seems to break some sites. I have 3 sites all error 500 on wp-admin after login.

Viewing 15 replies - 1 through 15 (of 26 total)
  • Plugin Author lukeseager

    (@lukeseager)

    Hi,

    Thanks for getting in touch and apologies for the issue.

    A 500 error is quite broad, so I’ll have to ask a lot of questions to help me pin point the problem.

    Are you having this problem on all of your website’s, or just some of them?

    What version of WordPress are you running on each site?

    What version of PHP are you running on each site?

    Are all of these sites on the same hosting? Do you have other sites on other hosts where it is working?

    Thread Starter harryfear

    (@harryfear)

    Yes, 3+ sites on the same stack of plugins.

    Other sites on the same server but with other plugin stacks are ok.

    Error 500 with no WP error readout available.

    Plugin Author lukeseager

    (@lukeseager)

    Thanks Harry.

    Can you please confirm:

    What version of WordPress the websites with an error are running, and is this different to those that are working?

    What version of PHP the broken websites are running? And is this different to those that are working?

    You mention other sites with different plugins are okay, can you give me a list of the plugins that are only installed on the websites that are now broken?

    Thanks

    Moderator Jan Dembowski

    (@jdembowski)

    Forum Moderator and Brute Squad

    @harryfear If @lukeseager logs into your site, they will promptly lose access to these forums and possibly have their plugins removed from this site. It really is that serious.

    There is not any scenario either on the forums or via email, Twitter, DM, smoke signals, etc. where that will be permitted for any forum user.

    @lukeseager Lose those credentials now. Seriously, that’s to protect you as well as users and no one wants to ask themselves “Hey, do we have any liability insurance?”

    While I know you have the best of intentions, it’s forum policy that you not ask users for admin or server access. Users on the forums aren’t your customers, they’re your open source collaborators, and requesting that kind of access can put you and them at high risk.

    If they are paying customers (such as people who bought a premium service/product from you) then by all means, direct them to your official customer support system. But in all other cases, you need to help them here on the forums.

    Thankfully are other ways to get information you need:

    You get the idea.

    We know volunteer support is not easy, and this guideline can feel needlessly restrictive. It’s actually there to protect you as much as end users. Should their site be hacked or have any issues after you accessed it, you could be held legally liable for damages. In addition, it’s difficult for end users to know the difference between helpful developers and people with malicious intentions. Because of that, we rely on plugin developers and long-standing volunteers (like you) to help us and uphold this particular guideline.

    When you help users here and in public, you also help the next person with the same problem. They’ll be able to read the debugging and solution and educate themselves. That’s how we get the next generation of developers.

    Plugin Author lukeseager

    (@lukeseager)

    Hi Jan,

    Thanks for the advice, I have been used to providing support to premium customers and hadn’t thought twice about providing that same support here on the forum for the free version of this plugin. Apologies.

    @harryfear – Could you please instead send over your server error logs, this may help pin-point where the 500 error came from in the first place.

    Also, please list the plugins that are unique to the websites that have broken.

    Plugin Author lukeseager

    (@lukeseager)

    Hi there,

    No luck so far I’m afraid, I haven’t had much to go on yet, only 2 people have been in touch with issues. I would like to ask anyone who is having an issue with the latest version to join in on this thread, so far I’m only aware of 2 people having issues with the new version of the plugin, which tells me the issue is limited to specific circumstances.

    To download a previous version of the plugin, please visit this page and select the version you’d like to use: https://wordpress.org/plugins/wp-persistent-login/advanced/

    For anyone with an issue, it would be helpful to get an error message from the plugin to find out what the problem is. Can you add the following lines to your functions.php file within your active Theme:

    // This enables debugging.
    define( ‘WP_DEBUG’, true );
    // This logs errors to a log file
    define( ‘WP_DEBUG_LOG’, true );
    // This stops errors showing on the front end
    define( ‘WP_DEBUG_DISPLAY’, false );

    Once that’s uploaded, can you activate Persistent Login and then check the debug log in wp-content/debug.log and send any errors that occured at the time you did the test.

    Thanks,
    Luke

    Thread Starter harryfear

    (@harryfear)

    Hi Luke,

    When I enable those debugging options, I don’t get any errors displayed or written to a debug log when I hit the 500 error – in fact the debug log file is never created. If I specify its path, it’s not ever written to.

    Any tips on this?

    Best, Harry.

    Plugin Author lukeseager

    (@lukeseager)

    Hi Harry,

    If you refresh the FTP client and see nothing in your wp-content folder after a minute or so, it’s possible WordPress doesn’t have permission to create the error.log file.

    Can you manually create a new error.log file inside your wp-content folder and give it permission 666, then try again?

    Thread Starter harryfear

    (@harryfear)

    Very interesting. Changing the file permission of error_log from 644 to 666 seemed to make a difference.

    There is no write to log, but there is now an in-browser error displayed.

    Seems to reveal a memory leak?

    Fatal error: Allowed memory size of 268435456 bytes exhausted (tried to allocate 12288 bytes) in /home/<redacted>/wp-includes/capabilities.php on line 1042

    I rolled back to Version 1.3.21, which doesn’t break the sites, but the latest version does.

    I isolated the plugin incompatibility to a triangle of plugins:
    • Latest WordPress Persistent Login
    • Latest Wordfence Security with firewall enabled (even without extended protection)
    • Latest Admin Menu Editor

    Disabling any one plugin resolved the issue.

    I could recreate this on Litespeed (LSWS) and Litespeed Enterprise servers.

    Looking at WPL, the latest version seems to have an enormous number of changes, right?

    Thread Starter harryfear

    (@harryfear)

    I’ve been able to recreate the issue on a fresh server.

    [Fresh CyberPanel box with PHP 7.4 on Vultr.]

    Process:
    • Install the 3 named plugins.
    • Setup the Wordfence firewall, including extended protection.
    • Enable all 3 plugins.
    • Logout.
    • Attempt login.
    • Error 500 presents.

    Further notes:
    • With WP debugging enabled as instructed, no error messages are printed to file or browser. No logs appear to be written by any of the 3 plugins.
    • Even with extended protection then disabled, still error 500.
    • Only way to restore site is to disable one of the 3 plugins.

    Plugin Author lukeseager

    (@lukeseager)

    Hi Harry,

    Thanks for the extra information.

    Can I ask, how many users have you got on these websites that you’ve tested and received a 500 error?

    I’ll give the 3 plugins together a test myself and report back.

    Thanks,
    Luke

    Thread Starter harryfear

    (@harryfear)

    Hi Luke,

    Very few users! 1-5!

    Best,

    Harry.

    Plugin Author lukeseager

    (@lukeseager)

    Thanks for the info! I’ll do some testing over the weekend and come back to you.

    Plugin Author lukeseager

    (@lukeseager)

    Hi,

    I’ve been doing some testing over the weekend and I have been able to replicate the issue.

    I’ve also found the line of code that seems to be causing the problem.

    Within /classes/wp-persistent-login.php, there is a line that uses the wp_set_auth_cookie core wordpress function.

    Commenting this line out removes the problem, but without it users will not remain logged in forever.

    The usage of the function is fine, there isn’t an error in Persistent Login or incorrect code.

    Digging into Wordfence, they use a filter that is called inside wp_set_auth_cookie which triggers some of their login security code, again there isn’t anything wrong with that code as far as I can see, but commenting it out resolves the issue too.

    I haven’t found the source of the problem in the admin menu plugin yet.

    I am looking at how I can rewrite my code to avoid this function, but I’m also going to get in touch with Wordfence to discuss the issue.

    Apologies there hasn’t been a quick fix over the weekend, but this is being looked into.

    Thanks,
    Luke

    Thread Starter harryfear

    (@harryfear)

    Hi Luke,

    Amazing that you’ve managed to pin it down so quickly to one troublesome part of the auth cookie flow!

    WordFence in the another support forum thread provided this email:
    wftest @ wordfence . com

    Sorry for the slow reply. I didn’t get any notification.

    Best,

    Harry.

Viewing 15 replies - 1 through 15 (of 26 total)
  • You must be logged in to reply to this topic.