ti

tiger Jul 28, 2019 #1

{“errorMessage”: “Session reuse detected, IPAddress logged.”, “error_message”: “Session reuse detected, IPAddress logged.”}

Can you point me how to fix/disable this?

My IP is dynamic, so every now and then it will be changed by my ISP. Sometimes it’s minutes, and it can be hours.

Before (1.8.6 or older) this is not a problem.

Cy

CyberPanel Jul 29, 2019 #2

Do you want to remove this limitation?

br

brunoxketty Jul 30, 2019 #3

I have the same problem, I have to go straight, only a vps is not accessible. How to troubleshoot this issue

Cy

CyberPanel Jul 31, 2019 #4

If your IP change frequently and you don’t need this protection, you can edit this file

https://github.com/usmannasir/cyberpanel/blob/1.8.0/CyberCP/secMiddleware.py

Remove line 11-40.

On server this file is available at /usr/local/CyberCP/CyberCP

then systemctl restart lscpd

br

brunoxketty Jul 31, 2019 #5

I did the procedure, but in the browser returns error 500 (solved - it was my mistake)

br

brunoxketty Jul 31, 2019 #6

Thanks Cyber Panel got it.
after I started giving this problem I would switch panels, but there is no better panel with this support.

li

linholiver Aug 25, 2019 #7

pls fix it
I same err
after remove line 11-40, i don’t use cyberpanel access anybutton

an

anhtuan Aug 31, 2019 #8

please fix that problem, still can not working anymore

an

anhtuan Sep 13, 2019 #9

If your IP change frequently and you don't need this protection, you can edit this file
https://github.com/usmannasir/cyberpanel/blob/1.8.0/CyberCP/secMiddleware.py

Remove line 11-40.

On server this file is available at /usr/local/CyberCP/CyberCP

then systemctl restart lscpd

How can i edit that file on my server? im not know that

an

anhtuan Sep 13, 2019 #10

I did the procedure, but in the browser returns error 500 (solved - it was my mistake)

i got error: 500
what’s next?

Cy

CyberPanel Sep 14, 2019 #11

@anhtuan

It is possible that you remove some additional lines from secMiddleware.py which is why you are getting 500 error.

an

anhtuan Sep 14, 2019 #12

@anhtuan
It is possible that you remove some additional lines from settings.py which is why you are getting 500 error.

please lest me now for fix that! which line to remove in setting.py?. so now im swicth to vpssim.

Cy

CyberPanel Sep 14, 2019 #13

In your secMiddleware.py file remove these lines

        try:
            uID = request.session['userID']
            ipAddr = request.META.get('REMOTE_ADDR')

            if ipAddr.find('.') > -1:
                if request.session['ipAddr'] == ipAddr:
                    pass
                else:
                    del request.session['userID']
                    del request.session['ipAddr']
                    logging.writeToFile(request.META.get('REMOTE_ADDR'))
                    final_dic = {'error_message': "Session reuse detected, IPAddress logged.",
                                 "errorMessage": "Session reuse detected, IPAddress logged."}
                    final_json = json.dumps(final_dic)
                    return HttpResponse(final_json)
            else:
                ipAddr = request.META.get('REMOTE_ADDR').split(':')[:3]

                if request.session['ipAddr'] == ipAddr:
                    pass
                else:
                    del request.session['userID']
                    del request.session['ipAddr']
                    logging.writeToFile(request.META.get('REMOTE_ADDR'))
                    final_dic = {'error_message': "Session reuse detected, IPAddress logged.",
                                 "errorMessage": "Session reuse detected, IPAddress logged."}
                    final_json = json.dumps(final_dic)
                    return HttpResponse(final_json)
        except:
            pass

Usually they are in line 11-40. Final code shoud look like

from plogical.CyberCPLogFileWriter import CyberCPLogFileWriter as logging
import json
from django.shortcuts import HttpResponse

class secMiddleware:

    def __init__(self, get_response):
        self.get_response = get_response

    def __call__(self, request):
        try:
            uID = request.session['userID']
            ipAddr = request.META.get('REMOTE_ADDR')

            
        if request.method == 'POST':
            try:
                #logging.writeToFile(request.body)
                data = json.loads(request.body)
                for key, value in data.iteritems():
                    if request.path.find('gitNotify') > -1:
                        break

                    # if request.path.find('users') > -1 or request.path.find('firewall') > -1 or request.path.find('servicesAction') > -1 or request.path.find('sslForHostName') > -1:
                    #     logging.writeToFile(request.body)
                    #     final_dic = {'error_message': "Data supplied is not accepted.",
                    #                  "errorMessage": "Data supplied is not accepted."}
                    #     final_json = json.dumps(final_dic)
                    #     return HttpResponse(final_json)

                    if type(value) == str or type(value) == unicode:
                        pass
                    else:
                        continue

                    if request.build_absolute_uri().find('saveSpamAssassinConfigurations') > -1 or request.build_absolute_uri().find('docker') > -1 or request.build_absolute_uri().find('cloudAPI') > -1 or request.build_absolute_uri().find('filemanager') > -1 or request.build_absolute_uri().find('verifyLogin') > -1 or request.build_absolute_uri().find('submitUserCreation') > -1:
                        continue
                    if key == 'ports' or key == 'imageByPass' or key == 'passwordByPass' or key == 'cronCommand' or key == 'emailMessage' or key == 'configData' or key == 'rewriteRules' or key == 'modSecRules' or key == 'recordContentTXT' or key == 'SecAuditLogRelevantStatus' or key == 'fileContent':
                        continue
                    if value.find(';') > -1 or value.find('&&') > -1 or value.find('|') > -1 or value.find('...') > -1 \\
                            or value.find("`") > -1 or value.find("$") > -1 or value.find("(") > -1 or value.find(")") > -1 \\
                            or value.find("'") > -1 or value.find("[") > -1 or value.find("]") > -1 or value.find("{") > -1 or value.find("}") > -1\\
                            or value.find(":") > -1 or value.find("<") > -1 or value.find(">") > -1:
                        logging.writeToFile(request.body)
                        final_dic = {'error_message': "Data supplied is not accepted.",
                                     "errorMessage": "Data supplied is not accepted."}
                        final_json = json.dumps(final_dic)
                        return HttpResponse(final_json)
                    if key.find(';') > -1 or key.find('&&') > -1 or key.find('|') > -1 or key.find('...') > -1 \\
                            or key.find("`") > -1 or key.find("$") > -1 or key.find("(") > -1 or key.find(")") > -1 \\
                            or key.find("'") > -1 or key.find("[") > -1 or key.find("]") > -1 or key.find("{") > -1 or key.find("}") > -1\\
                            or key.find(":") > -1 or key.find("<") > -1 or key.find(">") > -1:
                        logging.writeToFile(request.body)
                        final_dic = {'error_message': "Data supplied is not accepted.", "errorMessage": "Data supplied is not accepted."}
                        final_json = json.dumps(final_dic)
                        return HttpResponse(final_json)
            except BaseException, msg:
                logging.writeToFile(str(msg))
                response = self.get_response(request)
                return response
        response = self.get_response(request)
        return response

and this file is available at /usr/local/CyberCP/CyberCP

an

anhtuan Sep 14, 2019 #14

@CyberPanel : line 11 is: try
and line 40 is: pass
https://43.224.33.39:8090/websites/
Error 500 here

Cy

CyberPanel Sep 14, 2019 #15

Create ticket and mention ticket number here.

an

anhtuan Sep 14, 2019 #16

Create ticket and mention ticket number here.

Ticket #5FJ7PV thanks

w3

w3services Nov 10, 2019 #17

Hi 500 server error start.

Please confirm if 2 lines required or not. As your above not clear…

try:
uID = request.session[‘userID’]
ipAddr = request.META.get(‘REMOTE_ADDR’)

w3

w3services Nov 10, 2019 #18

The final code should look like ??

Why again in these 3 lines?

try:
uID = request.session[‘userID’]
ipAddr = request.META.get(‘REMOTE_ADDR’)

Its showing 500 server error. Please help.

wh

whattheserver Nov 10, 2019 #19

Backup current config
mv /usr/local/CyberCP/secMiddleware.py /usr/local/CyberCP/secMiddleware.py-bak

Download new version.
wget -O /usr/local/CyberCP/secMiddleware.py https://github.com/usmannasir/cyberpanel/raw/stable/CyberCP/secMiddleware.py

then download run the upgrade/update cache clearing script

wget -O /usr/local/CyberCP/upgrade.sh https://github.com/usmannasir/cyberpanel/raw/stable/upgrade.sh
chmod +x /usr/local/CyberCP/upgrade.sh

Then run this and give it a few minutes to clear cache and restart cyberpanel daemon
bash /usr/local/CyberCP/upgrade.sh

This should bring it back to stock.

The file has probably changed some since the original post was made.

Looks like relevant lines are 12-41 that need removed or commented out.

github.com

usmannasir/cyberpanel/blob/ecffcd59412fa0d94b1574df0c02b3027b0aebe9/CyberCP/secMiddleware.py#L12-L41


      
          try:
              uID = request.session['userID']
              ipAddr = request.META.get('REMOTE_ADDR')
          
          
    if ipAddr.find('.') > -1:
                  if request.session['ipAddr'] == ipAddr:
                      pass
                  else:
                      del request.session['userID']
                      del request.session['ipAddr']
                      logging.writeToFile(request.META.get('REMOTE_ADDR'))
                      final_dic = {'error_message': "Session reuse detected, IPAddress logged.",
                                   "errorMessage": "Session reuse detected, IPAddress logged."}
                      final_json = json.dumps(final_dic)
                      return HttpResponse(final_json)
              else:
                  ipAddr = request.META.get('REMOTE_ADDR').split(':')[:3]
          
          
        if request.session['ipAddr'] == ipAddr:
                      pass

This file has been truncated. show original

If you want to easily remove the lines via commenting them out(make them inactive)

this can be done via sed command below.
sed -i ‘12,41 s/^/#/’ /usr/local/CyberCP/CyberCP/secMiddleware.py

You can then confirm it via checking the lines right before and after.
sed -n ‘10,42p’ /usr/local/CyberCP/CyberCP/secMiddleware.py

Before:
root@ubuntu:~# sed -n ‘10,42p’ /usr/local/CyberCP/CyberCP/secMiddleware.py

def __call__(self, request):
    try:
        uID = request.session['userID']
        ipAddr = request.META.get('REMOTE_ADDR')

        if ipAddr.find('.') > -1:
            if request.session['ipAddr'] == ipAddr:
                pass
            else:
                del request.session['userID']
                del request.session['ipAddr']
                logging.writeToFile(request.META.get('REMOTE_ADDR'))
                final_dic = {'error_message': "Session reuse detected, IPAddress logged.",
                             "errorMessage": "Session reuse detected, IPAddress logged."}
                final_json = json.dumps(final_dic)
                return HttpResponse(final_json)
        else:
            ipAddr = request.META.get('REMOTE_ADDR').split(':')[:3]

            if request.session['ipAddr'] == ipAddr:
                pass
            else:
                del request.session['userID']
                del request.session['ipAddr']
                logging.writeToFile(request.META.get('REMOTE_ADDR'))
                final_dic = {'error_message': "Session reuse detected, IPAddress logged.",
                             "errorMessage": "Session reuse detected, IPAddress logged."}
                final_json = json.dumps(final_dic)
                return HttpResponse(final_json)
    except:
        pass
    if request.method == 'POST':

root@ubuntu:~#

After:
root@ubuntu:~# sed -i ‘12,41 s/^/#/’ /usr/local/CyberCP/CyberCP/secMiddleware.py
root@ubuntu:~# sed -n ‘10,42p’ /usr/local/CyberCP/CyberCP/secMiddleware.py

def __call__(self, request):

try:

uID = request.session[‘userID’]

ipAddr = request.META.get(‘REMOTE_ADDR’)

if ipAddr.find(‘.’) > -1:

if request.session[‘ipAddr’] == ipAddr:

pass

else:

del request.session[‘userID’]

del request.session[‘ipAddr’]

logging.writeToFile(request.META.get(‘REMOTE_ADDR’))

final_dic = {‘error_message’: “Session reuse detected, IPAddress logged.”,

“errorMessage”: “Session reuse detected, IPAddress logged.”}

final_json = json.dumps(final_dic)

return HttpResponse(final_json)

else:

ipAddr = request.META.get(‘REMOTE_ADDR’).split(‘:’)[:3]

if request.session[‘ipAddr’] == ipAddr:

pass

else:

del request.session[‘userID’]

del request.session[‘ipAddr’]

logging.writeToFile(request.META.get(‘REMOTE_ADDR’))

final_dic = {‘error_message’: “Session reuse detected, IPAddress logged.”,

“errorMessage”: “Session reuse detected, IPAddress logged.”}

final_json = json.dumps(final_dic)

return HttpResponse(final_json)

except:

pass

    if request.method == 'POST':

root@ubuntu:~#

root@ubuntu:~# systemctl restart lscpd
root@ubuntu:~#

wh

whattheserver Nov 10, 2019 #20

Actually, I coded an option you can enable or disable this within that file.

I do not have a dynamic session that changes to verify it that works, but the file works on my test server and has an if condition to only run if ‘true’ so in theory should work for you to toggle it off by setting value to ‘false’ without having to comment or delete lines in the core file which bound to be error-prone.

Download the file with option to toggle.
wget -O /usr/local/CyberCP/secMiddleware.py https://github.com/usmannasir/cyberpanel/raw/c335952b2a350690c79082e8ffb45cfebd2c039c/CyberCP/secMiddleware.py

Default: On ‘true’

To set to On ‘true’
sed -i “s/^sessionIPValidation =.*/sessionIPValidation = ‘true’/g” /usr/local/CyberCP/CyberCP/secMiddleware.py

To set to Off: ‘false’
sed -i “s/^sessionIPValidation =.*/sessionIPValidation = ‘false’/g” /usr/local/CyberCP/CyberCP/secMiddleware.py

To check status:
grep -E ‘^sessionIPValidation’ /usr/local/CyberCP/CyberCP/secMiddleware.py

Example of this toggled to On(true): Default
root@ubuntu:~# grep -E ‘^sessionIPValidation’ /usr/local/CyberCP/CyberCP/secMiddleware.py
sessionIPValidation = ‘true’
root@ubuntu:~#

Example of this toggled to Off(false):
root@ubuntu:~# grep -E ‘^sessionIPValidation’ /usr/local/CyberCP/CyberCP/secMiddleware.py
sessionIPValidation = ‘false’
root@ubuntu:~#

After toggling:
systemctl restart lscpd||service lscpd restart

Test

If it works ill submit a pull request to have it merged to the stable branch.

in

inspiredearth Feb 28, 2020 #21

@whattheserver : I just want to say thank you for your work on this. I can see you put a significant amount of time into helping out with this. It’s much appreciated.

MB

Mysterious_Beans Apr 29, 2020 #22

If you want to do this by commenting out (or removing) lines, then pay attention to the fact that the relevant line numbers may change with each update.

As of 2.0 the relevant lines are 17-47

na

nagione Jun 17, 2020 #23

Thanks @Mysterious_Beans … i did this as per your suggestion and it worked for me … Cheers !!!

it

itspathanofficial Oct 17, 2020 #24

given solutions are not working, please post the solution for this problem.

JM

Jonaylton Moura de Sousa Feb 27, 2021 #25

I think @CyberPanel should include it under security options and allow the user to switch it on or off

JM

Jonaylton Moura de Sousa Mar 01, 2021 #26

I tried both solutions suggested with no success, still getting the errors when IP changes

sh

shanyx Mar 20, 2021 #27

Type your comment> @CyberPanel said:

If your IP change frequently and you don’t need this protection, you can edit this file

https://github.com/usmannasir/cyberpanel/blob/1.8.0/CyberCP/secMiddleware.py

Remove line 11-40.

On server this file is available at /usr/local/CyberCP/CyberCP

then systemctl restart lscpd

Solution did nt work. cyberpanel did not work properly with cloudflare

Ma

Master3395 Mar 29, 2021 #28

I have the same issue using CloudFlare.
I can sometimes log in, and some times I get the error.
{“error_message”: “Session reuse detected, IPAddress logged.”, “errorMessage”: “Session reuse detected, IPAddress logged.”}

The tutorial over just ends up with internal error 500.

me

mediakular Apr 02, 2021 #29

I have the same issue. I am also using CloudFlare.
After logging in I can browse 1-2 sites on cyberpanel, then I have to login again.

Everything works well when I log in with HTTP:: (only loading of each page takes much longer).
I only have the issue described above when I log in with HTTPS::.

Same behavior for others?

ar

arworld Apr 15, 2021 #30

For cloudflare users please replace REMOTE_ADDR with True-Client-IP and for nginx please replace REMOTE_ADDR with X_REAL_IP
your issue will be resolved no need to remove a single line and also no 500 error cheers
regards
Aditya Rathore World

ar

arworld Apr 15, 2021 #31

@arworld said:
For cloudflare users please replace REMOTE_ADDR with True-Client-IP and for nginx please replace REMOTE_ADDR with X_REAL_IP
your issue will be resolved no need to remove a single line and also no 500 error cheers
regards
Aditya Rathore World

ipAddr = request.META.get(‘True-Client-IP’).split(‘:’)[:3]

you can comment above line if using cloudflare as it have single header ip only
def call(self, request):
try:
uID = request.session[‘userID’]
admin = Administrator.objects.get(pk=uID)
ipAddr = request.META.get(‘True-Client-IP’)

        if ipAddr.find('.') > -1:
            if request.session['ipAddr'] == ipAddr or admin.securityLevel == secMiddleware.LOW:
                pass
            else:
                del request.session['userID']
                del request.session['ipAddr']
                logging.writeToFile(request.META.get('True-Client-IP'))
                final_dic = {'error_message': "Session reuse detected, IPAddress logged.",
                             "errorMessage": "Session reuse detected, IPAddress logged."}
                final_json = json.dumps(final_dic)
                return HttpResponse(final_json)
        else:

ipAddr = request.META.get(‘True-Client-IP’).split(‘:’)[:3]

            if request.session['ipAddr'] == ipAddr or admin.securityLevel == secMiddleware.LOW:
                pass
            else:
                del request.session['userID']
                del request.session['ipAddr']
                logging.writeToFile(request.META.get('True-Client-IP'))
                final_dic = {'error_message': "Session reuse detected, IPAddress logged.",
                             "errorMessage": "Session reuse detected, IPAddress logged."}
                final_json = json.dumps(final_dic)
                return HttpResponse(final_json)
    except:
        pass

sa

sagar May 07, 2021 #32

i also tried every methods now i got 500
Internal Server Error

me

mediakular May 14, 2021 #33

@arworld said:
For cloudflare users please replace REMOTE_ADDR with True-Client-IP and for nginx please replace REMOTE_ADDR with X_REAL_IP
your issue will be resolved no need to remove a single line and also no 500 error cheers
regards
Aditya Rathore World

Thank you @arworld for your help! This seems to work for me very well. So far I haven’t had any problems with the session reuse anymore!

ar

arworld Apr 04, 2022 #34

Glad it helped you too

of

ofm1990 Nov 09, 2024 #35

This error has become frequent again now with this latest emergency update.

Is the solution still the same? Delete lines?

HL

HLT Nov 15, 2024 #36

Can try my method, it can solve this problem

BS

Ben S Nov 24, 2024 #37

Hi, I tried to bypass Cloudflare but the error is still persistent. I am facing a dilemma, upgrade and cannot access CP or leave it as Version 2.7 and leave myself vulnerable.

My IP is fixed.

Hoped I can get some help on this issue. Thanks you!

HL

HLT Nov 25, 2024 #38

You can try this method to solve your problem. If you modify the problem, you still need to clean up the slow storage of cloudflare.

SG

Santos Guerra Feb 15, 2025 #39

I use cloudflare, pause cloudflare, log in, activate cloudflare again, it’s solved. It’s as simple as that.