note 58350 deleted from ref.session by betz

Note Submitter: matthew at polarweb dot ca ---- While trying to get the php-session-based mambo CMS to work, I stumbled across a problem that: Whenever I tried to log in to the administration back end, the CMS would 1) Correctly verify that I had indeed entered the username and password correctly. 2) If in IE, it would maintain the session (ie let me into the first page of the administration back-end) until I clicked on a link*, and then would boot me back out to the login page. In Firefox it would immediately return me to the login page. * If I didn't click on the link, but copied the target of the link, and pasted it into my browser, I would not get booted back out to the login page! I found the temporary directory where session files were being stored and noticed that for every unsuccessful login, two session files were being created. [Seems bad!] One file was full of good session information, and the other (the one that was referenced by a cookie on my machine) was empty! The solution (that took several hours to find) was to comment out the line: session.referer_check = apachesecurity.net From the php.ini file. I have not yet experimented with this, but I would guess that a better solution would be to replace the "apachesecurity.net" with the domainname of the server? Hope this helps other people who have problems with sessions not being maintained / kept alive. keywords / key phrases: two session files one empty, session lost when clicked but not when url copy pasted into browser, mambo login loop, mambo authentication