User tests: Successful: Unsuccessful:
Pull Request resolves # .
The "Authentication - Cookie" plugin logs a security message when a remember-me login fails because the stored token does not match (possible stolen/guessed cookie). The message uses the language string PLG_AUTHENTICATION_COOKIE_ERROR_LOG_LOGIN_FAILED, but onUserAuthenticate()
never loads the plugin's language file, so the raw language key is written to the log instead of the translated text.
This PR adds $this->loadLanguage(); in onUserAuthenticate(), consistent with onPrivacyCollectAdminCapabilities() in the same plugin, which already loads the language before using Text. The string is now translated before it is passed to Log::add().
everything.php / category security).#__user_keys and a joomla_remember_me_* cookie.token value of the matching row in #__user_keys to a wrong hash.)administrator/logs/everything.php) and look at the security entry.The log contains the untranslated language key:
PLG_AUTHENTICATION_COOKIE_ERROR_LOG_LOGIN_FAILED
The log contains the translated message, e.g.:
Cookie login failed for user 0.
Yes, for user 0. This is another bug and will be fixed later!
Please select:
Documentation link for guide.joomla.org:
No documentation changes for guide.joomla.org needed
Pull Request link for manual.joomla.org:
No documentation changes for manual.joomla.org needed
| Status | New | ⇒ | Pending |
| Category | ⇒ | Front End Plugins |
I have tested this item ✅ successfully on 98e973d
I have tested this item ✅ successfully on 98e973d
I have tested this item ✅ successfully on 98e973d
I have tested this item ✅ successfully on 98e973d
| Status | Pending | ⇒ | Ready to Commit |
| Labels |
Added:
bug
PR-5.4-dev
|
||
RTC
RTC
| Labels |
Added:
RTC
|
||
✅ Final test before merge
PLG_AUTHENTICATION_COOKIE_ERROR_LOG_LOGIN_FAILED beforeCookie login failed for user 0.| Status | Ready to Commit | ⇒ | Fixed in Code Base |
| Closed_Date | 0000-00-00 00:00:00 | ⇒ | 2026-06-19 15:47:55 |
| Closed_By | ⇒ | muhme |
Thank you very much @tecpromotion for your contribution. Thanks to @brianteeman and @CSGoat0 for testing.
Tried both - when refreshing the front end i am still logged in and nothing new in the logs