vBulletin 3.8.4 PL2 breaking cookie authentication from non-VB Pages

[evannn]

Hi guys,

Anyone encountered this issue? Non-VB pages login used to work fine before 3.8.4 PL2. After rolling out the patch, the non-VB pages (w/ or without cookie) broke.

Can the developers shed some light on what are the changes in login mechanism?

Thank

--------------- Added [DATE]1262598588[/DATE] at [TIME]1262598588[/TIME] ---------------

Has there been some changes in the hashing/salt generation algo?

[NeDra]

Actually in the new 384 PL2
If you logout, here we have a huge issue were we can't even login anymore.
The login last for 1 page maximum, I also need to get the non-VB login to work after I fix the forum cookies issue.

I can't even login to the admin pannel right now...

--------------- Added [DATE]1262658936[/DATE] at [TIME]1262658936[/TIME] ---------------

evannn, I fixed my problem by not using a subdomain.
Also make sure that your cookies in the admin control pannel is set to ".domainname.com"
So it work for all subdomain.

Settings > Options > Cookies and HTTP Header Options > Cookie Domain

[evannn]

Hi Nedra,

yes.the cookie domain is already specified

The forums is located at http://forums.mysubdomain.com/
the other non vB pages are located at mysubdomain.com/page1.php etc

[mastertek2000]

there is a problem with this you can find help here


http://www.vbulletin.com/forum/showt...e-login-issues

[evannn]

Hi Friends,

I have filed a support ticket with vBulletin and they responded.

If you are on 3.8.4 PL2,
Go into includes/functions.php, around line 34, you should see a
define('COOKIE_SALT', 'XXXX');

What I did was:
Replace this line with the same line from 3.8.4 PL1

I confirm this resolved the problem. But I am concerned whether does this has any security implications.

Thanks