Session Key ERROR - Running istallation

Session Key ERROR - Running istallation

by Bhupinder Singh -
Number of replies: 4

Hi all,

I am stuck with the inability to make changes to the structure ie add blocks etc. on the followign account

After copying the blocks / files to the appropriate place when I go back and with editing on try to go forward with the ADMIN command The admin interface shows up:

..../ Administration » Configuration » Variables

At the bottom there is the continue button on pressing the same we have the following message displayed.

Sorry, but your session key could not be confirmed to carry out this action. This security feature prevents against accidental or malicious execution of important functions in your name. Please make sure you really wanted to execute this function.

On continuing we come back to the FRONTPAGE.

I am desparately in need of help and assistance in resolving this issue.

Thanks to all in advace.

Garry


f2.png
by Bhupinder Singh - Friday, 3 February 2006, 06:33 PM
 

Hi all,

I am stuck with the inability to make changes to the structure ie add blocks etc. on the followign account

After copying the blocks / files to the appropriate place when I go back and with editing on try to go forward with the ADMIN command The admin interface shows up:

..../ Administration » Configuration » Variables

At the bottom there is the continue button on pressing the same we have the following message displayed.

Sorry, but your session key could not be confirmed to carry out this action. This security feature prevents against accidental or malicious execution of important functions in your name. Please make sure you really wanted to execute this function.

On continuing we come back to the FRONTPAGE.

I am desparately in need of help and assistance in resolving this issue.

Thanks to all in advace.

Garry

Average of ratings: -
In reply to Bhupinder Singh

Re: Session Key ERROR - Running istallation

by Jan Dierckx -

Ok, Garry,

I had a look at the line that generates this error message. It is generated if the session key sent with a form is not identical to the one stored on the server for that particular user.

Only suggestion I can come up with is: can you check if the session key is sent together with administration page form. (See screenshot made with the Web developer extension for Firefox which allows you to display all fields of a form including the hidden ones).

Reading your previous posts I have noticed you tested quite a lot of new modules and blocks. Most of the testers use a separate installation, sometimes just a local desktop install. I hesitate asking this, but: is this running installation that needs urgent repair the one you did all those testing on?

If so, I would really suggest rolling back to a more stable version of Moodle and restoring a backup. It's very difficult to pinpoint what is causing this error.

If not, I would suggest describing in more detail what exactly you were doing before you got the error. Which Moodle version, etc... Also try turning secureforms of / visiting the same page when not in editing mode.

Good luck!

Attachment ScreenShot018.jpg
In reply to Jan Dierckx

Re: Session Key ERROR - Running istallation

by Bhupinder Singh -

Hi Jan,

This is a Pre Production isntance.

I have four instances running on the server.

Each has its own database.  I am using MySql 4.1 Moodle 4.5.3.

I was trying to install an additional block for which I had made the nessesary changes in the Blocks and Lang modules. When I went to the admin interface instead of any tables being created I got the

FOLLOWING SCREEN:

VOEMS
You are logged in as Bhupinder Singh (Logout)
 

 
  

 

fullscreen_maximize.gif
float.gif
switch_plus.gif

Variables

Interface | Security | Operating System | Maintenance | Mail | User | Permissions | Miscellaneous

Interface

lang: Afrikaans (af) عربي (ar) Беларуская (be) Български (bg) Bosanski (bs) Català (ca) Cestina (cs) Dansk (da) Deutsch (de) Deutsch - Du (de_du) Deutsch (de_utf8) Ελληνικά (el) English (en) English (en_us) Español - Internacional (es) Español - Argentina (es_ar) Español - España (es_es) Español - Mexico (es_mx) Eesti (et) Euskara (eu) فارسی (fa) فارسي (fa_utf8) Suomi (fi) Filipino (fil) Français (fr) Français - Canada (fr_ca) Gaeilge (ga) Galego (gl) עברית (he) עברית (he_utf8) हिन्दी (hi) Hrvatski (hr) Hrvatski (hr_utf8) Magyar (hu) Indonesian (id) Italiano (it) Japanese (ja) Japanese (ja_utf8) ქართული (ka_utf8) Khmer (km_utf8) ಕನ್ನಡ (kn_utf8) 한국어 (ko) íêµ­ì´ (ko_utf8) Lietuvių (lt) Latvieu (lv) Maori - Ngai Tahu (mi_nt) Māori - Tainui (mi_tn_utf8) Bahasa Melayu (ms) Nederlands (nl) Nynorsk (nn) Norsk (no) Norsk (no_gr) Polski (pl) Português - Portugal (pt) Português - Brasil (pt_br) Română (ro) Русский (ru) Slovenèina (sk) Slovenèina (sl) Slovenčina (sl_utf8) Soomaali (so) Shqip (sq) Српски (sr_utf8) Svenska (sv) Thai (th) Thai (th_utf8) Tagalog (tl) Tagalog (tl_utf8) Türkçe (tr) Українська (uk) Vietnamese (vi_utf8) 简体中文 (zh_cn) 简体中文 (zh_cn_utf8) ¥¿Å餤¤å (zh_tw) 正體中文 (zh_tw_utf8)
 Choose a default language for the whole site. Users can override this setting later.
langmenu: No Yes
 Choose whether or not you want to display the general-purpose language menu on the home page, login page etc. This does not affect the user's ability to set the preferred language in their own profile.
langlist:
 Leave this blank to allow users to choose from any language you have in this installation of Moodle. However, you can shorten the language menu by entering a comma-separated list of language codes that you want. For example: en,es_es,fr,it
langcache: No Yes
 Cache the language menu. Saves a lot of memory and processing power. If you enable this, the menu takes a few minutes to update after you have added or removed languages.
locale:
 Choose a sitewide locale - this will affect the format and language of dates. You need to have this locale data installed on your operating system. (eg en_US or es_ES). If you don't know what to choose leave it blank.
timezone: Server's local time GMT-13 GMT-12.5 GMT-12 GMT-11.5 GMT-11 GMT-10.5 GMT-10 GMT-9.5 GMT-9 GMT-8.5 GMT-8 GMT-7.5 GMT-7 GMT-6.5 GMT-6 GMT-5.5 GMT-5 GMT-4.5 GMT-4 GMT-3.5 GMT-3 GMT-2.5 GMT-2 GMT-1.5 GMT-1 GMT-0.5 GMT GMT+0.5 GMT+1 GMT+1.5 GMT+2 GMT+2.5 GMT+3 GMT+3.5 GMT+4 GMT+4.5 GMT+5 GMT+5.5 GMT+6 GMT+6.5 GMT+7 GMT+7.5 GMT+8 GMT+8.5 GMT+9 GMT+9.5 GMT+10 GMT+10.5 GMT+11 GMT+11.5 GMT+12 GMT+12.5 GMT+13
 You can set the default timezone here. This is the only the DEFAULT timezone for displaying dates - each user can override this by setting their own in their profile. "Server time" here will make Moodle default to the server's operating system setting, but "Server time" in the user profile will make the user default to this timezone setting.
country: Select a country Afghanistan Albania Algeria American Samoa Andorra Angola Anguilla Antarctica Antigua and Barbuda Argentina Armenia Aruba Australia Austria Azerbaijan Bahamas Bahrain Bangladesh Barbados Belarus Belgium Belize Benin Bermuda Bhutan Bolivia Bosnia and Herzegovina Botswana Bouvet Island Brazil British Indian Ocean Territory Brunei Darussalam Bulgaria Burkina Faso Burundi Cambodia Cameroon Canada Cape Verde Cayman Islands Central African Republic Chad Chile China Christmas Island Cocos (Keeling) Islands Colombia Comoros Congo Cook Islands Costa Rica Cote D'Ivoire Croatia (Hrvatska) Cuba Cyprus Czech Republic Denmark Djibouti Dominica Dominican Republic East Timor Ecuador Egypt El Salvador Equatorial Guinea Eritrea Estonia Ethiopia Falkland Islands (Malvinas) Faroe Islands Fiji Finland France France; Metropolitan French Guiana French Polynesia French Southern Territories Gabon Gambia Georgia Germany Ghana Gibraltar Greece Greenland Grenada Guadeloupe Guam Guatemala Guinea Guinea-Bissau Guyana Haiti Heard and Mc Donald Islands Honduras Hong Kong Hungary Iceland India Indonesia Iran (Islamic Republic of) Iraq Ireland Israel Italy Jamaica Japan Jordan Kazakhstan Kenya Kiribati Korea; Democratic People's Republic of Korea; Republic of Kosovo Kuwait Kyrgyzstan Lao People's Democratic Republic Latvia Lebanon Lesotho Liberia Libyan Arab Jamahiriya Liechtenstein Lithuania Luxembourg Macau Macedonia; Former Yugoslav Republic of Madagascar Malawi Malaysia Maldives Mali Malta Marshall Islands Martinique Mauritania Mauritius Mayotte Mexico Micronesia; Federated States of Moldova; Republic of Monaco Mongolia Montserrat Morocco Mozambique Myanmar Namibia Nauru Nepal Netherlands Netherlands Antilles New Caledonia New Zealand Nicaragua Niger Nigeria Niue Norfolk Island Northern Mariana Islands Norway Oman Pakistan Palau Palestine Panama Papua New Guinea Paraguay Peru Philippines Pitcairn Poland Portugal Puerto Rico Qatar Reunion Romania Russian Federation Rwanda Saint Kitts and Nevis Saint Lucia Saint Vincent and the Grenadines Samoa San Marino Sao Tome and Principe Saudi Arabia Senegal Serbia and Montenegro Seychelles Sierra Leone Singapore Slovakia (Slovak Republic) Slovenia Solomon Islands Somalia South Africa Spain Sri Lanka St. Helena St. Pierre and Miquelon Sudan Suriname Svalbard and Jan Mayen Islands Swaziland Sweden Switzerland Syrian Arab Republic Taiwan Tajikistan Tanzania; United Republic of Thailand Togo Tokelau Tonga Trinidad and Tobago Tunisia Turkey Turkmenistan Turks and Caicos Islands Tuvalu Uganda Ukraine United Arab Emirates United Kingdom United States of America Uruguay Uzbekistan Vanuatu Vatican City State (Holy See) Venezuela Vietnam Virgin Islands (British) Virgin Islands (U.S.) Wales Wallis And Futuna Islands Western Sahara Yemen Zaire Zambia Zimbabwe
 If you set a country here, then this country will be selected by default on new user accounts. To force users to choose a country, just leave this unset.
framename:
 If you are embedding Moodle within a web frame, then put the name of this frame here. Otherwise this value should remain as '_top'
themelist:
 Leave this blank to allow any valid theme to be used. If you want to shorten the theme menu, you can specify a comma-separated list of names here (Don't use spaces!). For example: standard,orangewhite.
allowuserthemes: No Yes
 If you enable this, then users will be allowed to set their own themes. User themes override site themes (but not course themes)
allowcoursethemes: No Yes
 If you enable this, then courses will be allowed to set their own themes. Course themes override all other theme choices (site, user, or session themes)
allowuserblockhiding: No Yes
 Do you want to allow users to hide/show side blocks throughout this site? This feature uses Javascript and cookies to remember the state of each collapsible block, and only affects the user's own view.
showblocksonmodpages: No Yes
 Some activity modules support blocks on their pages. If you turn this on, then teachers will be able to add side blocks on those pages, otherwise the interface does not show this feature.
tabselectedtofront: No Yes
 On tables with tabs, should the row with the currently selected tag be placed at the front

Security

displayloginfailures: Nobody Administrators Administrators and teachers Everybody
 This will display information to selected users about previous failed logins.
notifyloginfailures: Nobody Administrator All administrators
 If login failures have been recorded, email notifications can be sent out. Who should see these notifications?
notifyloginthreshold: 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 56 57 58 59 60 61 62 63 64 65 66 67 68 69 70 71 72 73 74 75 76 77 78 79 80 81 82 83 84 85 86 87 88 89 90 91 92 93 94 95 96 97 98 99 100
 If notifications about failed logins are active, how many failed login attempts by one user or one IP address is it worth notifying about?
secureforms: No Yes
 Moodle can use an additional level of security when accepting data from web forms. If this is enabled, then the browser's HTTP_REFERER variable is checked against the current form address. In a very few cases this can cause problems if the user is using a firewall (eg Zonealarm) configured to strip HTTP_REFERER from their web traffic. Symptoms are getting 'stuck' on a form. If your users are having problems with the login page (for example) you might want to disable this setting, although it might leave your site more open to brute-force password attacks. If in doubt, leave this set to 'Yes'.
loginhttps: No Yes
 Turning this on will make Moodle use a secure https connection just for the login page (providing a secure login), and then afterwards revert back to the normal http URL for general speed. CAUTION: this setting REQUIRES https to be specifically enabled on the web server - if it is not then YOU COULD LOCK YOURSELF OUT OF YOUR SITE.
runclamonupload: No Yes
 Run clam AV on file upload? You will need a correct path in pathtoclam for this to work. (Clam AV is a free virus scanner that you can get from http://www.clamav.net/)
pathtoclam:
 Path to clam AV. Probably something like /usr/bin/clamscan or /usr/bin/clamdscan. You need this in order for clam AV to run.
quarantinedir:
 If you want clam AV to move infected files to a quarantine directory, enter it here. It must be writable by the webserver. If you leave this blank, or if you enter a directory that doesn't exit or isn't writable, infected files will be deleted. Do not include a trailing slash.
clamfailureonupload: Treat files as OK Treat files like viruses
 If you have configured clam to scan uploaded files, but it is configured incorrectly or fails to run for some unknown reason, how should it behave? If you choose 'Treat files like viruses', they'll be moved into the quarantine area, or deleted. If you choose 'Treat files as OK', the files will be moved to the desination directory like normal. Either way, admins will be alerted that clam has failed. If you choose 'Treat files like viruses' and for some reason clam fails to run (usually because you have entered an invalid pathtoclam), ALL files that are uploaded will be moved to the given quarantine area, or deleted. Be careful with this setting.

Operating System

gdversion: GD is not installed GD 1.x is installed GD 2.x is installed
 Indicate the version of GD that is installed. The version shown by default is the one that has been auto-detected. Don't change this unless you really know what you're doing.
dbsessions: No Yes
 If enabled, this setting will use the database to store information about current sessions. This is especially useful for large/busy sites or sites built on cluster of servers. For most sites this should probably be left disabled so that the server disk is used instead. Note that changing this setting now will log out all current users (including you).
sessiontimeout: 4 hours 3 hours 2 hours 1.5 hours 60 minutes 45 minutes 30 minutes 15 minutes 5 minutes
 If people logged in to this site are idle for a long time (without loading pages) then they are automatically logged out (their session is ended). This variable specifies how long this time should be.
sessioncookie:
 This setting customises the name of the cookie used for Moodle sessions. This is optional, and only useful to avoid cookies being confused when there is more than one copy of Moodle running within the same web site.
zip:
 Indicate the location of your zip program (Unix only, optional). If specified, this will be used to create zip archives on the server. If you leave this blank, then Moodle will use internal routines.
unzip:
 Indicate the location of your unzip program (Unix only, optional). If specified, this will be used to unpack zip archives on the server. If you leave this blank, then Moodle will use internal routines.
pathtodu:
 Path to du. Probably something like /usr/bin/du. If you enter this, pages that display directory contents will run much faster for directories with a lot of files.
slasharguments: file.php?file=/pic.jpg file.php/pic.jpg
 Files (images, uploads etc) are provided via a script using 'slash arguments' (the second option here). This method allows files to be more easily cached in web browsers, proxy servers etc. Unfortunately, some PHP servers don't allow this method, so if you have trouble viewing uploaded files or images (eg user pictures), set this variable to the first option.
proxyhost:
 If this server needs to use a proxy computer (eg a firewall) to access the Internet, then provide the proxy hostname and port here. Otherwise leave it blank.
proxyport:
 

Maintenance

longtimenosee: Never 1000 days 365 days 180 days 150 days 120 days 90 days 60 days 30 days 21 days 14 days 7 days
 If students haven't logged in for a very long time, then they are automatically unsubscribed from courses. This parameter specifies that time limit.
deleteunconfirmed: Never 7 days 6 days 5 days 4 days 3 days 2 days 1 days 12 hours 6 hours 1 hours
 If you are using email authentication, this is the period within which a response will be accepted from users. After this period, old unconfirmed accounts are deleted.
loglifetime: Never delete logs 1000 days 365 days 180 days 150 days 120 days 90 days 60 days 30 days
 This specifies the length of time you want to keep logs about user activity. Logs that are older than this age are automatically deleted. It is best to keep logs as long as possible, in case you need them, but if you have a very busy server and are experiencing performance problems, then you may want to lower the log lifetime.

Mail

smtphosts:
 Give the full name of one or more local SMTP servers that Moodle should use to send mail (eg 'mail.a.com' or 'mail.a.com;mail.b.com'). If you leave it blank, Moodle will use the PHP default method of sending mail.
smtpuser:
 If you have specified an SMTP server above, and the server requires authentication, then enter the username and password here.
smtppass:
 
noreplyaddress:
 Emails are sometimes sent out on behalf of a user (eg forum posts). The email address you specify here will be used as the "From" address in those cases when the recipients should not be able to reply directly to the user (eg when a user chooses to keep their address private).
digestmailtime: 00 01 02 03 04 05 06 07 08 09 10 11 12 13 14 15 16 17 18 19 20 21 22 23
 People who choose to have emails sent to them in digest form will be emailed the digest daily. This setting controls which time of day the daily mail will be sent (the next cron that runs after this hour will send it).
allowemailaddresses:
 If you want to restrict all new email addresses to particular domains, then list them here separated by spaces. All other domains will be rejected. eg ourcollege.edu.au .gov.au
denyemailaddresses:
 To deny email addresses from particular domains list them here in the same way. All other domains will be accepted. eg hotmail.com yahoo.co.uk

User

sitepolicy:
 If you have a site policy that all users must see and agree to before using this site, then specify the URL to it here, otherwise leave this field blank. The URL can point to anywhere - one convenient place would be a file in the site files. eg http://yoursite/file.php/1/policy.html
fullnamedisplay: Language First name + Surname Surname + First name First name
 This defines how names are shown when they are displayed in full. For most mono-lingual sites the most efficient setting is the default "Given names + Surname", but you may choose to hide surnames altogether, or to leave it up to the current language pack to decide (some languages have different conventions).
extendedusernamechars: No Yes
 Enable this setting to allow students to use any characters in their usernames (note this does not affect their actual names). The default is "false" which restricts usernames to be alphanumeric characters only
autologinguests: No Yes
 Should visitors be logged in as guests automatically when entering courses with guest access?

Permissions

teacherassignteachers: No Yes
 Should ordinary teachers be allowed to assign other teachers within courses they teach? If 'No', then only course creators and admins can assign teachers.
allowunenroll: No Yes
 If this is set 'Yes', then students are allowed to unenroll themselves from courses whenever they like. Otherwise they are not allowed, and this process will be solely controlled by the teachers and administrators.
allusersaresitestudents: No Yes
 For activities on the front page of the site, should ALL users be considered as students? If you answer "Yes", then any confirmed user account will be allowed to participate as a student in those activities. If you answer "No", then only users who are already a participant in at least one course will be able to take part in those front page activities. Only admins and specially assigned teachers can act as teachers for these front page activities.
showsiteparticipantslist: Site teachers All teachers Students and teachers
 All of these site students and site teachers will be listed on the site participants list. Who shall be allowed to see this site participants list?
forcelogin: No Yes
 Normally, the front page of the site and the course listings (but not courses) can be read by people without logging in to the site. If you want to force people to log in before they do ANYTHING on the site, then you should enable this setting.
forceloginforprofiles: No Yes
 Enable this setting to force people to login as a real (non-guest) account before being allowed to see the user profile pages. By default this is disabled ("false") so that prospective students can read about the teachers of each course, but this also means that web search engines can see them.
opentogoogle: No Yes
 If you enable this setting, then Google will be allowed to enter your site as a Guest. In addition, people coming in to your site via a Google search will automatically be logged in as a Guest. Note that this only provides transparent access to courses that already allow guest access.
maxbytes: 2MB 1MB 500KB 100KB 50KB 10KB
 This specifies a maximum size that uploaded files can be throughout the whole site. This setting is limited by the PHP setting upload_max_filesize and the Apache setting LimitRequestBody. In turn, maxbytes limits the range of sizes that can be chosen at course level or module level.
messaging: No Yes
 Should the messaging system between site users be enabled?
allowobjectembed: No Yes
 As a default security measure, normal users are not allowed to embed multimedia (like Flash) within texts using explicit EMBED and OBJECT tags in their HTML (although it can still be done safely using the mediaplugins filter). If you wish to allow these tags then enable this option.

Miscellaneous

maxeditingtime: 60 minutes 45 minutes 30 minutes 15 minutes 5 minutes 1 minutes
 This specifies the amount of time people have to re-edit forum postings, glossary comments etc. Usually 30 minutes is a good value.
debug: No Yes
 If you turn this on, then PHP's error_reporting will be increased so that more warnings are printed. This is only useful for developers.
perfdebug: No Yes
 If you turn this on, performance info will be printed in the footer of the standard theme
enablerssfeeds: No Yes
 This switch will enable RSS feeds from across the site. To actually see any change you will need to enable RSS feeds in the individual modules too - go to the Modules settings under Admin Configuration.

WHEN I press the SAVE CANGES BUTTON AT THE BOTTOM  I get a new screen which shows the follwoing.


Sorry, but your session key could not be confirmed to carry out this action. This security feature prevents against accidental or malicious execution of important functions in your name. Please make sure you really wanted to execute this function.
I can do every thing else except make changes. Is there anyway to reset the session key variable.
Hope the above helps in identifying the problem.
GARRY
In reply to Bhupinder Singh

Re: Session Key ERROR - Running istallation

by Jan Dierckx -
Which block(s) did you install?
In reply to Jan Dierckx

Re: Session Key ERROR - Running istallation

by Bhupinder Singh -

I tried to install the Random Picture Block, MArking block and digital clock.

I regularly make fresh instances method used is as under.

Copy files into a new folder. Amend the config file create a new database and import the data liles.

I use this as a back up.

I am given to understand that APACHE Server may be a possible source of this ERROR.???

Garry