Topic-icon Must be a bug.

Active Subscriptions:

None
12 years 4 months ago - 12 years 4 months ago #40594 by none
Must be a bug. was created by none
Ok. Today I noticed something really strange. We have 2 users. User "A" and user "B".
User "A" is a basic joomla registered user. User "B" is a Twitter registered user.
User "A" logs in by joomla login and logs out. After user "B" logs in on the same computer as soon as user "A" logged out.
JFBconnect fetches the data from twitter and fills in the community builder fields with friends count etc. After user "B" logs out and user "A" logs in again with joomla login.
User "A" inherits all data from user "B" and all data from user "B" will be shown in user "A"'s profil page. How is it possible? I checked the mysql database and user "A" gets all data from user "B". They just logged in and out on the same computer.
Last edit: 12 years 4 months ago by none.
The topic has been locked.
Support Specialist
12 years 4 months ago #40618 by alzander
Replied by alzander on topic Must be a bug.
That's definitely strange and obviously the incorrect behavior. JFBConnect shouldn't be retaining any knowledge of the previous user on it's own. We simply use the session management of Joomla to store temporal data. The session data is completely controlled by Joomla, so we'll have to test more.

When you say the information is showing up in the user's profile, do you mean the user's CB profile? Just making sure so we can test a similar way.

Thanks,
Alex
The topic has been locked.
Active Subscriptions:

None
12 years 4 months ago #40631 by none
Replied by none on topic Must be a bug.
Hi Alex,

Yes, I meant the user "B" 's twitter data gets imported into user "A" 's CB profile fields. I tested the same thing with Facebook login but it didn't occur with facebook just with twitter. Data like: followers count, friend count and everything. It even changes the user name in the "user map" menu in JFBconnect.
The topic has been locked.
Active Subscriptions:

None
12 years 4 months ago - 12 years 4 months ago #40748 by none
Replied by none on topic Must be a bug.
Hi Alex, do you have any update on this issue?
Thanks
Last edit: 12 years 4 months ago by none.
The topic has been locked.
Support Specialist
12 years 4 months ago #40784 by alzander
Replied by alzander on topic Must be a bug.
Sorry, I don't have a great answer yet. I did some cursory testing the other day to make sure there were no obvious issues we could find, and I wasn't able to uncover anything. I'm planning to dive further into this tomorrow or Friday at the latest to see what I can find.

I'll definitely let you know what I find, and thanks for your patience,
Alex
The topic has been locked.
Active Subscriptions:

None
12 years 4 months ago #40820 by none
Replied by none on topic Must be a bug.
Ok, here is a video.

User "none" is a joomla registered user. He logs in and no facebook, twitter data in his profile.
After "none" logs out.
A Twitter user logs in by Twitter login.
Here is an interesting thing happen. The system logs in user "none" on behalf of Twitter and not the Twitter user.
The other thing I dont really understand why Google button still appears after I logging in using Twitter. Why is the Google login button still there?
The topic has been locked.
Support Specialist
12 years 4 months ago #40830 by alzander
Replied by alzander on topic Must be a bug.
Thanks for the video, it helps understand how you're testing a bit. The browser area was a little cutoff, so I didn't get to see everything though, but I think I see some issues.

First, we've been trying to recreate this and have been unable to under various situations. We are testing on a site with CB with field mappings and such and tried to match up as much as we could.

The one thing from your video that stands out is that, when you click the logout button, there was an error page. I'm assuming from there you're clicking the "Back" button. In that case, since there was an error, the full logout process may not have been completed by Joomla. This could easily be leaving a session open inside Joomla. When you next login via Twitter, the session data from the previous user may be fetched from Joomla and used by JFBConnect. In that case, JFBConnect would simply think the 'old' user is still logged in and trying to add his Twitter account to his existing Joomla account.

That would explain why the fields are imported and why the connection between the accounts is being made.

When the logout process occurs normally, all session data for a user should be destroyed. That's taken care of by Joomla. That way, on the next page load, JFBConnect would think there is a completely new visitor to the site.. there's be no state variables associated with the previous user. Running into an error on logout (possibly not clearing the session) and then hitting the back button (possibly sending the 'old' user's session cookie) is the only thing I can see from your video that would explain the issue.

In that case, I'd have to stress to you to fix the error. Then, even the back button shouldn't cause problems. I'd still test without hitting the back button at first though.

The other thing I dont really understand why Google button still appears after I logging in using Twitter. Why is the Google login button still there?

JFBConnect lets logged in users associate their current account to other social networks that they haven't already connected to. This lets them login with that social network later.

If you don't want that feature, disable the "Show Connect Account Button(s)" setting in the SCLogin -> Logout parameters area.

I hope that helps explain, but let me know if you still run into issues.. or let me know a lot more about what the logout error in your video is.

Thanks,
Alex
The topic has been locked.
Active Subscriptions:

None
12 years 4 months ago - 12 years 4 months ago #40831 by none
Replied by none on topic Must be a bug.
Hi Alex,

Thanks for your answer but let me clarify something first. I didn't hit the back button. The error message appears by another reason which I had mentioned in another topic of JFBconnect. I get an error message because previously we imported the old joomla users (from Joomla 1.5) and Joomla 2.5 gives an error message because user ID 63 doesn't exist in the Juser table. Thats it. I just refresh the page after when I get the error message. What I didn't record is the admin area. After logging out and logging in again with the joomla registered user, the user name changes in JFBconnect userlist as well. The name of the twitter user changes to the joomla registered user's username. At this stage I think anyone can evade/change/use someone's Twitter data.
Last edit: 12 years 4 months ago by none.
The topic has been locked.
Support Specialist
12 years 4 months ago #40840 by alzander
Replied by alzander on topic Must be a bug.
That's definitely something we can't recreate then and can't understand how it would be happening.

Can you Private Message me admin credentials for your site and we'll investigate further? We'll have to create a few test users, delete them, and check your configuration settings to see if we can narrow down what's happening on your site.

You can PM me by clicking my mail icon under my avatar to the left.

Thanks,
Alex
The topic has been locked.
Support Specialist
12 years 4 months ago #41027 by alzander
Replied by alzander on topic Must be a bug.
Very sorry for the delayed response on this. I was just able to access your admin area and test on the front end. A few things I noted:
1) I logged in at first on the front end with the username you sent me. Then, I logged out. Then, I logged in with a Twitter account I have. A new account was registered. I then logged out of the Twitter account and back in with 'alex' and it was not updated with the Twitter information from the other account. I logged out and in many times from both accounts and never saw the behavior you describe.

In other words, I wasn't able to recreate the issue you mention.

2) Looking at the JFBConnect -> Usermap area, there is a 'mapping' between the Joomla user 'none' and a Twitter connection. It's row ID 17 in the Usermap area. If you're logging in with the Twitter account associated with "none", the Twitter information will be imported into 'none's profile.

Finally, for the Userid 63 error issue, I don't think that's related to JFBConnect. However, I'm not sure where it's coming from. There is no 'mapping' in the JFBConnect Usermap table between user 63 and a social network, so JFBConnect shouldn't be trying to load that user ID. However, when I registered with Twitter, there were many similar notices that a specific User ID couldn't be loaded (about a dozen). I'm not sure where those were coming from either, and JFBConnect doesn't seem to have information about those user's stored anywhere.

I know you mentioned before that you think that issue may be related to JFBConnect.. do you know how or why? Any information you have on where it may have come from or what we can narrow it down to will help us come up with a solution.. if it is related to us.

Thanks,
Alex
The topic has been locked.