[SOLVED] Submitted Form is Invalid

[swalker2001]

I'm getting the dreaded "Submitted form is invalid" message. Site was just moved from old server to new server. I pointed my machine to the new server before the DNS was switched and tested it...everything was fine. But now that the move is complete it is broken.


Support Request Template
What version of phpBB are you using? phpBB 3.3.11
What is your board's URL? https://scripting.wheatstone.com
Who do you host your board with? LiquidWeb
How did you install your board? I used a tool provided by my host
What is the most recent action performed on your board? Please select your answer
Is registration required to reproduce this issue? No
Do you have any MODs installed? Yes
Do you have any extensions installed? Yes
What MODs do you have installed? Not sure, can't log in
What extensions do you have installed? Not sure, can't log in
What styles do you currently have installed? prosilver, black darkblue, black red, crbon, x-creamy
What language(s) is your board currently using? English
Which database type/version are you using? MySQL 5
What is your level of experience? New to PHP but not phpBB
What actions did you take (updating your board; installing a MOD, style or extension; etc.) prior to this problem becoming noticeable? LiquidWeb migrated us to a new server. I tested the new server by changing my computer's hosts file prior to the switchover to make sure everything worked and it did. Night before last they made the move and repointed DNS etc.
Please describe your problem. I cannot log into the site. I receive the "The submitted form was invalid. Try submitting again" error. I have read on this subject on this site and it seems this may be a cookie issue but how would I change anything on the cookie settings if I can't log in? And what would I need to change?
Generated by SRT Generator

[danieltj]

Do you have database access via something like phpMyAdmin? If you can’t log into the ACP then updating your settings in the database would help.

What are your cookie settings set to?

Edit:

Also just to tick this off the debugging list, have you cleared your browser cookies for your forum completely?

[ssl]

Have you tried accessing with a new web browser?

[swalker2001]

Do you have database access via something like phpMyAdmin? If you can’t log into the ACP then updating your settings in the database would help.

What are your cookie settings set to?

Edit:

Also just to tick this off the debugging list, have you cleared your browser cookies for your forum completely?

I do have phpMyAdmin access. Not sure what to look for. Yes, I've cleared cookies and even tried Edge (which I've never used). In any case, nobody else can log in either.

[swalker2001]

Have you tried accessing with a new web browser?

Yes I tried Edge which I've only ever used to download Firefox and Chrome. But nobody can log in, it isn't just me.

[ssl]

Your cookie settings seem correct, have you asked your host about this problem?
Do you have a test account to share?

[swalker2001]

Your cookie settings seem correct, have you asked your host about this problem?
Do you have a test account to share?

I have asked the host but no reply as yet. I can inject a test account into the users table but I doubt if you will be able to log in with it. You could try registering a new account.

[ssl]

You could try registering a new account.

No because

Code: Select all

Your account has been created. However, this board requires account activation by the administrator group. An email has been sent to them and you will be informed when your account has been activated.

Tried this: viewtopic.php?p=15620966&sid=c7db60ee82 ... #p15620966
This will create a new admin account which allows access to the ACP

[EA117]

Note in general, no test account is needed for "form invalid" investigation. Just attempt login. Doesn't matter what non-blank string you put for username and password, if the form is going to be declared invalid. If you get "unknown user/password", that actually means the form is validating successfully.

I get a different session ID (sid= parameter in the URL, sid cookie being set in the response) on nearly every submit when visiting your site, so that's why it can't validate the form. The session has to stay the same between viewing the form and submitting the form in order for the form validation to work.

You're behind CloudFlare, and I'm wondering if your "pre-final move" test was against the actual host? And "broken now" that you're coming to that same host but through CloudFlare after updating the CloudFlare DNS to point to your new host.

By default CloudFlare does make every phpBB client look as though they're coming from the IP address of CloudFlare's proxy rather than the actual client IP address. Had you maybe accounted for this on the old server by using Apache mod_remoteip, or installing a CloudFlare extension which restores the original client IP address for CloudFlare? (And this configuration is absent on the new server.) Or maybe you just didn't have CloudFlare before, and didn't have to account for this?

Regarding "ssl got through fine, but EA117 saw the issue." I see random success too if I try enough times. The session ID matching phpBB performs is using other data besides just IP address, such as the user agent (web browser name, bot name, etc.). If the same client comes through the same CloudFlare proxy with the same user agent (web browser) twice in a row, they'll get the previously created session. (Random success.) But if anyone or anything visits the site through the same CloudFlare proxy but with a different user agent before you're able to visit twice, this "spoils" the session for that IP address and your second visit gets a new session. (Form invalid.)

[swalker2001]

You could try registering a new account.

No because

Code: Select all

Your account has been created. However, this board requires account activation by the administrator group. An email has been sent to them and you will be informed when your account has been activated.

Tried this: viewtopic.php?p=15620966&sid=c7db60ee82 ... #p15620966
This will create a new admin account which allows access to the ACP

I was able to get in by deactivating the Cloudflare proxy. I saw your account request...thanks for trying...

[swalker2001]

You're behind CloudFlare, and I'm wondering if your "pre-final move" test was against the actual host? And "broken now" that you're coming to that same host but through CloudFlare after updating the CloudFlare DNS to point to your new host.

By default CloudFlare does make every phpBB client look as though they're coming from the IP address of CloudFlare's proxy rather than the actual client IP address. Had you maybe accounted for this on the old server by using Apache mod_remoteip, or installing a CloudFlare extension which restores the original client IP address for CloudFlare? (And this configuration is absent on the new server.) Or maybe you just didn't have CloudFlare before, and didn't have to account for this?

I had them turn off the Cloudflare proxy and was able to log in. Thanks for that. Now to figure out what is misconfigured there because we were using Cloudflare before and all was working properly.

[thecoalman]

All the IP's are from Cloudflare and this can cause problems with phpBB and other applications. Ideally you install and configure remote_ip but this is not something you can do with shared hosting. Without it anything using/recording the IP such as your server logs will all be Cloudflare IP's

https://developers.cloudflare.com/suppo ... sitor-ips/

There is two extensions for this specifically for phpBB but they haven't been updated in a while.

https://www.phpbb.com/customise/db/find ... 5D=36&sc=1

If you are going to use Cloudflare I'd strongly suggest getting your own free Cloudflare account instead of doing it through the host.

[swalker2001]

You're behind CloudFlare, and I'm wondering if your "pre-final move" test was against the actual host? And "broken now" that you're coming to that same host but through CloudFlare after updating the CloudFlare DNS to point to your new host.

Posting for the benefit of anyone else who has the problem. Here is the response from our host after we turned off the Cloudflare proxy and found that we were again able to login:

Code: Select all

Upon checking, I noticed that mod_remoteip was already enabled, but the CloudFlare IPs had not been configured in the mod_remoteip. I’ve now added the CloudFlare IPs, so the real IPs should appear on the server instead of the CloudFlare IPs.

Could you please enable CloudFlare on scripting.wheatstone.com and let us know if the issue persists?

This did in fact fix the problem in our case. Thanks to all who chimed in to help. Marking this solved.