Web Wiz Forums - Logging in from multiple locations

Print Page | Close Window

Logging in from multiple locations

Printed From: Web Wiz Forums
Category: Web Wiz Web App Support Forums
Forum Name: Web Wiz Forums
Forum Description: Support forum for Web Wiz Forums application.
URL: https://forums.webwiz.net/forum_posts.asp?TID=10551
Printed Date: 11 April 2026 at 4:34pm
Software Version: Web Wiz Forums 12.08 - https://www.webwizforums.com

Topic: Logging in from multiple locations

Posted By: Kraven
Subject: Logging in from multiple locations
Date Posted: 21 May 2004 at 8:28am

Hello,

I have recently upgraded to version 7.8 of the forums and my users have noticed something different happening. Some of them connecto the forums from work and from home and prior to version 7.8, the forums would keep them logged in at both locations (same account). Now, however, you can't stay logged in from two different computers at once. It isn't related to operating systems or browsers since I've polled the users and they use everything from Mozilla to IE and Win 98 to XP and they all have the same problem.

To reproduce it, I've been testing with my computer (winXP, IE 6 and Mozilla Firefox) and my laptop (win98se, IE 5). When I log in on my computer, everything works fine. When I log in on the laptop, everything works fine on the laptop. After I've logged in on the laptop, however, the computer is no longer logged in and I get the "only users with specific permissions can access this forum" message.

Is this a new security feature or is there something else going on here?

Thanks for the help.

Replies:

Posted By: WebWiz-Bruce
Date Posted: 21 May 2004 at 10:19am

This was a security feature sometime ago that was removed, but has been put back in again with version 7.8 after a few security sites reported this as a security flaw in the software.

Now the auto login feature only works on the computer you are on, if you use another machine you will need to login again.

The security code used to track users and also used for keeping the user logged in is now changed each time you login. It is also changed in other parts of the forum code more often. This will help prevent hackers getting hold of valid security codes, but does mean a user will need to re login again when moving to different machines.

-------------
https://www.webwiz.net/web-wiz-forums/forum-hosting.htm" rel="nofollow - Web Wiz Forums Hosting
https://www.webwiz.net/web-hosting/windows-web-hosting.htm" rel="nofollow - ASP.NET Web Hosting

Posted By: Kraven
Date Posted: 21 May 2004 at 10:43am

Thank you for the prompt reply. I'll just tell my users to deal with it

Posted By: Patrick Melton
Date Posted: 30 September 2004 at 11:01am

Is there any way to disable this "feature"?

Posted By: dj air
Date Posted: 30 September 2004 at 11:58am

to disable it

We Advised not to though

delete the section in the login page that updates the field User_code.

Posted By: ndamico
Date Posted: 30 September 2004 at 2:38pm

dj air,

is this what one would delete?

'For extra security create a new user code for the user
strUserCode = userCode(strUsername)

   'Save the new usercode back to the database
   rsCommon.Fields("User_code") = strUserCode
   rsCommon.Update

thank you!

Posted By: ndamico
Date Posted: 30 September 2004 at 2:48pm

well i tried the above and it didn't work.. perhaps you can tell me what i need to remove.. when i removed the above code it just prevents anyone from logging in

Posted By: Patrick Melton
Date Posted: 30 September 2004 at 2:50pm

You can just comment it out so it looks like this:

'For extra security create a new user code for the user
strUserCode = userCode(strUsername)

   'Save the new usercode back to the database
   'rsCommon.Fields("User_code") = strUserCode
   'rsCommon.Update

Posted By: dj air
Date Posted: 01 October 2004 at 6:27am

Patrick Melton wrote:

You can just comment it out so it looks like this:

'For extra security create a new user code for the user
strUserCode = userCode(strUsername)

   'Save the new usercode back to the database
   'rsCommon.Fields("User_code") = strUserCode
   'rsCommon.Update

this will not work. the code below is what you need. The code above still creates a new usercode, and making it so you wont be able to login at all.



'For extra security create a new user code for the user
   strUserCode = rsCommon("User_code")

   'Save the new usercode back to the database
   'rsCommon.Fields("User_code") = strUserCode
   'rsCommon.Update

use this code. its the bold section that is needed, as you need to get the usercode from the database.

Posted By: ndamico
Date Posted: 01 October 2004 at 1:17pm

dj air-

thank you! that worked. much apprecaited!

Posted By: Patrick Melton
Date Posted: 01 October 2004 at 1:58pm

I disagree dj air - why would you change that line? You don't need to read it in at all. First, because it's read in directly above, and secondly because you're not going to do anything with it.

Basically, all you need to do is comment out these two lines:

'rsCommon.Fields("User_code") = strUserCode
'rsCommon.Update

I've done that and not modified anything else and it works perfect.

Posted By: Patrick Melton
Date Posted: 01 October 2004 at 2:08pm

dj air -

My apologies - you were right. My site partner had added that line up above - it wasn't in the original code.

So do what he said. I'm a moron.

Posted By: Cerebus
Date Posted: 02 December 2004 at 10:34pm

I have a question on this - it can be disabled but highly suggested not to? What loophole exactly does this allow? We're receiving several complaints about this feature from dual box users, but if disabling it will leave us open to some dangerous hack, then they can live with it.

If it's simply being worried about an account being logged in more than once, then I'd tend towards modding it out.

Thanks for any explanation.

-------------
Cerebus
http://www.calloffate.com - Call of Fate Guildmaster
~ Serving the MMOG community since 1999! ~

Posted By: dj air
Date Posted: 03 December 2004 at 5:50am

yes its because people can be logged in more than 1 place,

if you want ot disable it, refer to my last post on page 1, that shows what needs to be done to disable it, it is advised not to but you can.