- Posts: 4
- Thank you received: 0
Kunena 6.3.0 released
The Kunena team has announce the arrival of Kunena 6.3.0 [K 6.3.0] in stable which is now available for download as a native Joomla extension for J! 4.4.x/5.0.x/5.1.x. This version addresses most of the issues that were discovered in K 6.2 and issues discovered during the last development stages of K 6.3
If you are having problems then, for your own benefit, it would save us all a lot of time if you would kindly post your
configuration report
when you ask for help from this forum. If you do not post your configuration report we will not ask you for it but you will probably not get your problem solved, either.
Question E-mail Subscription Link & Spoof Guest Users
10 years 9 months ago #2
by sozzled
Blue Eagle vs. Crypsis reference guide
Read my blog and
Replied by sozzled on topic E-mail Subscription Link & Spoof Guest Users
Can we try to break down these issues into smaller, more manageable parts.
Let's look first at the question about the Remember Me checkbox. As far as I know, this checkbox exists for those people who use a web browser and do not have some kind of "remember what form fields I used last time I visited this website" feature. On submitting the form, the Remember Me checkbox causes Kunena to write a cookie on the user's PC and the cookie is used to populate the form fields (at least, that's my understanding of what it's used for and maybe I'm wrong).
But checking the Remember Me checkbox does not automatically login the user to the site ... and I think that's where the difference lies in understanding what this issue is all about. Just because the Username and Password fields are filled in with the details of the account that was used the last time the person accessed your website from that particular PC - remember that cookies only exist on the PC where you accessed a website from - this does not mean that a user is logged-in simply by visiting a web page. The user still has to press the Login button.
Further, the ability to "remember" the contents of form fields depends on the platform and the browser that you used. When I access the Kunena website from my iPad, the form fields are never populated with the information that I used between when I last accessed the site and when I turned off my iPad. Safari for iPad does not seem to have any "store cookies" or "store form field" information (at least, not that I have been able to discover).
So can we first eliminate the factors that I have described above?
Let's look first at the question about the Remember Me checkbox. As far as I know, this checkbox exists for those people who use a web browser and do not have some kind of "remember what form fields I used last time I visited this website" feature. On submitting the form, the Remember Me checkbox causes Kunena to write a cookie on the user's PC and the cookie is used to populate the form fields (at least, that's my understanding of what it's used for and maybe I'm wrong).
But checking the Remember Me checkbox does not automatically login the user to the site ... and I think that's where the difference lies in understanding what this issue is all about. Just because the Username and Password fields are filled in with the details of the account that was used the last time the person accessed your website from that particular PC - remember that cookies only exist on the PC where you accessed a website from - this does not mean that a user is logged-in simply by visiting a web page. The user still has to press the Login button.
Further, the ability to "remember" the contents of form fields depends on the platform and the browser that you used. When I access the Kunena website from my iPad, the form fields are never populated with the information that I used between when I last accessed the site and when I turned off my iPad. Safari for iPad does not seem to have any "store cookies" or "store form field" information (at least, not that I have been able to discover).
So can we first eliminate the factors that I have described above?
Blue Eagle vs. Crypsis reference guide
Read my blog and
Please Log in or Create an account to join the conversation.
10 years 9 months ago - 10 years 9 months ago #3
by ozzie1989
Replied by ozzie1989 on topic E-mail Subscription Link & Spoof Guest Users
Thanks for that information.
The 'Remember Me' function in Joomla, on my website at least, definately keeps the user logged in until they log out on that particular device. You are right it uses a Cookie to do this.
This is how my members use the function and they report that even if they don't visit the website for a week or more they are still logged in when they return?
I have tested it myself and can easily re-create the issue by checking the 'Remember Me' box - I can go directly to any link on the website that's only accessible to registered users and it works fine, but if the first page I go to is a Kunena page I get the access denied error I mention above. This only applies to external links opening up the website, if you are already on the website and use the menu etc to access the forum it all works fine.
Any help appreciated
thanks!
The 'Remember Me' function in Joomla, on my website at least, definately keeps the user logged in until they log out on that particular device. You are right it uses a Cookie to do this.
This is how my members use the function and they report that even if they don't visit the website for a week or more they are still logged in when they return?
I have tested it myself and can easily re-create the issue by checking the 'Remember Me' box - I can go directly to any link on the website that's only accessible to registered users and it works fine, but if the first page I go to is a Kunena page I get the access denied error I mention above. This only applies to external links opening up the website, if you are already on the website and use the menu etc to access the forum it all works fine.
Any help appreciated
thanks!
Last edit: 10 years 9 months ago by ozzie1989.
Please Log in or Create an account to join the conversation.
10 years 9 months ago #4
by sozzled
A user remains logged-in for as long as the session cookie is "alive" when the session cookie expires the user is logged-out. The expiry time for a user's Joomla session is defined by the value (in minutes) of
Joomla Global Configuration » Server » Session Settings » Session Lifetime
Kunena also has a session setting (a value in seconds), defined by
Kunena Forum » Configuration » General » Basic Settings » Session Lifetime
When people have problems with users being "logged-out" unexpectedly, we have discussed the suggested arrangement where you should define these two values the same. That is, if you have a Joomla Session Lifetime of 15 minutes (which is the default) then you should, likewise, set the Kunena Session Lifetime to 1200 seconds (which is not the default). The Kunena Session Lifetime is important for
As far as the possibility that a user can login, close a web browser page and revisit the site a week later and expect to pick up from where they left off before, that's not only unusual, I have never heard of such a possibility occurring. This, to me, would pose a risk to security by allowing anyone to use someone else's PC and do all manner of things without the former user being aware of them.
Blue Eagle vs. Crypsis reference guide
Read my blog and
Replied by sozzled on topic E-mail Subscription Link & Spoof Guest Users
I do not think that's how Joomla works at all. Perhaps if you asked the Joomla forum for this information, and post the considered reply from one of the members of the Joomla development team here, there might be a dissenting view.ozzie1989 wrote: The 'Remember Me' function in Joomla, on my website at least, definItely keeps the user logged in until they log out on that particular device. You are right it uses a Cookie to do this.
A user remains logged-in for as long as the session cookie is "alive" when the session cookie expires the user is logged-out. The expiry time for a user's Joomla session is defined by the value (in minutes) of
Joomla Global Configuration » Server » Session Settings » Session Lifetime
Kunena also has a session setting (a value in seconds), defined by
Kunena Forum » Configuration » General » Basic Settings » Session Lifetime
When people have problems with users being "logged-out" unexpectedly, we have discussed the suggested arrangement where you should define these two values the same. That is, if you have a Joomla Session Lifetime of 15 minutes (which is the default) then you should, likewise, set the Kunena Session Lifetime to 1200 seconds (which is not the default). The Kunena Session Lifetime is important for
... access rights recalculation, whoisonline display and NEW indicator. Once a session expires beyond that timeout, access rights and the NEW indicator are reset.
As far as the possibility that a user can login, close a web browser page and revisit the site a week later and expect to pick up from where they left off before, that's not only unusual, I have never heard of such a possibility occurring. This, to me, would pose a risk to security by allowing anyone to use someone else's PC and do all manner of things without the former user being aware of them.
Blue Eagle vs. Crypsis reference guide
Read my blog and
Please Log in or Create an account to join the conversation.
Time to create page: 0.574 seconds