RTC bug PR-5.4-dev Pending

User tests: Successful: Unsuccessful:

avatar tecpromotion
tecpromotion
19 Jun 2026

Pull Request resolves # .

  • I read the Generative AI policy and my contribution is either not created with the help of AI or is compatible with the policy and GNU/GPL 2 or later.

Summary of Changes

The "Authentication - Cookie" plugin logs a security message when a remember-me login fails because the stored token does not match (possible stolen/guessed cookie). The message uses the language string PLG_AUTHENTICATION_COOKIE_ERROR_LOG_LOGIN_FAILED, but onUserAuthenticate()
never loads the plugin's language file, so the raw language key is written to the log instead of the translated text.

This PR adds $this->loadLanguage(); in onUserAuthenticate(), consistent with onPrivacyCollectAdminCapabilities() in the same plugin, which already loads the language before using Text. The string is now translated before it is passed to Log::add().

Testing Instructions

  1. Make sure the "Authentication - Cookie" plugin is enabled and that error logging is on (everything.php / category security).
  2. On the frontend, log in with the "Remember Me" box checked. This creates a row in #__user_keys and a joomla_remember_me_* cookie.
  3. Simulate a token mismatch: in the browser dev tools edit that cookie and change the part before the dot (the token), leaving the part after the dot (the series) unchanged. (Alternatively, change the token value of the matching row in #__user_keys to a wrong hash.)
  4. Reload a frontend page so the cookie authentication runs.
  5. Open the log file (administrator/logs/everything.php) and look at the security entry.

Actual result BEFORE applying this Pull Request

The log contains the untranslated language key:

PLG_AUTHENTICATION_COOKIE_ERROR_LOG_LOGIN_FAILED

Expected result AFTER applying this Pull Request

The log contains the translated message, e.g.:
Cookie login failed for user 0.

Yes, for user 0. This is another bug and will be fixed later!

Link to documentations

Please select:

  • Documentation link for guide.joomla.org:

  • No documentation changes for guide.joomla.org needed

  • Pull Request link for manual.joomla.org:

  • No documentation changes for manual.joomla.org needed

avatar tecpromotion tecpromotion - open - 19 Jun 2026
avatar tecpromotion tecpromotion - change - 19 Jun 2026
Status New Pending
avatar joomla-cms-bot joomla-cms-bot - change - 19 Jun 2026
Category Front End Plugins
avatar brianteeman
brianteeman - comment - 19 Jun 2026

Simulate a token mismatch: in the browser dev tools edit that cookie and change the part before the dot (the token), leaving the part after the dot (the series) unchanged. (Alternatively, change the token value of the matching row in #__user_keys to a wrong hash.)

Tried both - when refreshing the front end i am still logged in and nothing new in the logs

avatar brianteeman brianteeman - test_item - 19 Jun 2026 - Tested successfully
avatar brianteeman
brianteeman - comment - 19 Jun 2026

I have tested this item ✅ successfully on 98e973d


This comment was created with the J!Tracker Application at issues.joomla.org/tracker/joomla-cms/47985.

avatar brianteeman
brianteeman - comment - 19 Jun 2026

I have tested this item ✅ successfully on 98e973d


This comment was created with the J!Tracker Application at issues.joomla.org/tracker/joomla-cms/47985.

avatar CSGoat0 CSGoat0 - test_item - 19 Jun 2026 - Tested successfully
avatar CSGoat0
CSGoat0 - comment - 19 Jun 2026

I have tested this item ✅ successfully on 98e973d


This comment was created with the J!Tracker Application at issues.joomla.org/tracker/joomla-cms/47985.

avatar CSGoat0
CSGoat0 - comment - 19 Jun 2026

I have tested this item ✅ successfully on 98e973d


This comment was created with the J!Tracker Application at issues.joomla.org/tracker/joomla-cms/47985.

avatar richard67 richard67 - change - 19 Jun 2026
Status Pending Ready to Commit
Labels Added: bug PR-5.4-dev
avatar richard67
richard67 - comment - 19 Jun 2026

RTC


This comment was created with the J!Tracker Application at issues.joomla.org/tracker/joomla-cms/47985.

avatar richard67
richard67 - comment - 19 Jun 2026

RTC


This comment was created with the J!Tracker Application at issues.joomla.org/tracker/joomla-cms/47985.

avatar muhme muhme - change - 19 Jun 2026
Labels Added: RTC
avatar muhme
muhme - comment - 19 Jun 2026

✅ Final test before merge

  • Seen PLG_AUTHENTICATION_COOKIE_ERROR_LOG_LOGIN_FAILED before
  • Applied PR with Patch Tester, seen Cookie login failed for user 0.
avatar muhme muhme - change - 19 Jun 2026
Status Ready to Commit Fixed in Code Base
Closed_Date 0000-00-00 00:00:00 2026-06-19 15:47:55
Closed_By muhme
avatar muhme muhme - close - 19 Jun 2026
avatar muhme muhme - merge - 19 Jun 2026
avatar muhme
muhme - comment - 19 Jun 2026

Thank you very much @tecpromotion for your contribution. Thanks to @brianteeman and @CSGoat0 for testing.

Add a Comment

Login with GitHub to post a comment