Screwed up fresh intall in half a minute...

Hi all

I was trying a tutorial (http://codingpad.maryspad.com/2009/03/29/building-a-website-with-modx-for-newbies-part-2-installing-modx/), after installing I got to the login screen.

There’s two options, I filled in the username and password correctly and there is an error, or I made a mistake in the username and/or password.

Either way, I keep getting this message when I try to access the manager, or anything that has to do something with administration:
"A possible CSRF attempt was detected from referer: http://localhost/modx%20tutorial/manager/." (and of course I’m not able to actually access the manager)

I am using the latest version of XAMPP as well as MODX (1.0.1)

I already tried restarting XAMPP

Thanks in advance

Greets, Kenny.

Hello,

Did you rename the ht.access file to .htaccess? If so change it back and see if that makes a difference.

Hi

No, I did not change ht.access files myself.
I did a search and each .htaccess file is in a folder related to xampp only, not to my modx installation. On the other hand, each ht.access file is in a folder related to one of the 2 modx installations.

I must admit that i have tried one or two other installs and have removed their databases, but forgot to remove one folder (of a certain install of modx) in the xampp/htdocs directory. That one is now removed. When I can access the login page again, I’ll try again to see if it still flips when filling in the username and password.

I also noticed when I tried about five minutes ago, that when I login with an incorrect username or password, he gives the regular "incorrect username or password" message, but when I fill in a username and password I used during the installation proces, he gives the error mentioned in my starting post.
Now I’m starting to doubt if I used this specific username and password for database access or for the manager.

Grtz, K?!

PS: I this takes to long then I’ll just restart with I new installation, but solving the problem is always more interesting of course

Is this any good http://modxcms.com/forums/index.php?topic=36771.0

well I just tried it

I saw this before I posted too, but I didn’t find the row they mentioned, but it was on the third page as is said later on in the topic.
I changed it now ("validate_referrer" to "0") but I’m still getting the same error, although this might be because I’m still blocked from my previous attempt. Maybe, when I’m able to access that login page again, he won’t trip when I fill in the username and password.

I was also thinking, when I put that value for "validating the referrer" to false, I might be opening some doors to hackers (if I need to do this with a real site of course, it doesn’t matter for something on xampp, but you get the point...)

BobRay posted an interesting link to a possible solution (http://modxcms.com/forums/index.php/topic,41329.0.html).

This is what they say on the site:

If the "Forgot Password" email on the login page doesn’t work, there’s another way in. Log in to your host’s cPanel (or the equivalent) and run phpMyAdmin. Select your MODx database and open the modx_user_attributes table. Find the default admin user (it should be the first record). Make sure blocked, blockeduntil, blockedafter, and failedlogincount are all set to 0. If not, click on the little pencil at the left to edit that record. Set those fields to 0 in the Value column, and click on the "Go" button at the bottom.

Now open the modx_manager_users table (in MODx Revolution it’s just modx_users) and find the default admin user. Make a note of the username. Click on the little pencil to edit that user, enter e10adc3949ba59abbe56e057f20f883e in the password field, and click on the "Go" button at the bottom. This sets your password to 123456.

You should now be able to login using the original username and the password: 123456. Be sure to change your password to something more secure after logging in.

The weird thing is that all these fields ARE set to 0 and the row also mentions 2 succesful logins, but I’m still getting that error

When I tried accessing the manager page with firefox, I got to the password field againg (I don’t know if I was already unblocked, or if it worked because of using another brower {I’ve been using google Chrome until now}) but when filling in the new password "123456", I got blocked AGAIN.

I have now reset the password, I’m still blocked, and am going to sleep... We’ll see what happens tomorrow.

Thanks for the responses, I hope we’ll find a solution.

Ok, I was able to get to the login screen today.

Now I’m sure of what’s going on:
when I fill in incorrect username or password, he just gives the regular "incorrect username or password" error, and I’m able to try again
when I fill in the correct I get the "A possible CSRF attempt was detected from referer" message... and in the database, the login count is increased with 1...

I don’t understand why, but that’s what happens.

I think I’ll go for a clean install...

First of all: sorry for posting 4 times in a row in my own thread :^p

I started a new install today (this time I paid some more attention to it) and it works, I’m able to log in.

If anyone is still interested and comes up with a solution, I kept the old website and database so I can still test it, it might be interesting to find out what the problem is.
But I’m able to continue working now .

Thanks for the help that was already offered.

Greetings, Kenny

While I’m not sure this is the answer, there is a setting in the manager called "Validate HTTP_REFERER headers" which is supposed to detect CSRF attacks and block them. Disabling that (directly in the database since you have no way to access the manager) might allow you to login.

Dear

I have already set this referrer to 0, but thanks for the effort.

Greets, Kenny