Problem to logout

ivangneiding · 20 Feb

Hi.
Today I updated my Flarum install and since then I cannot logout. The url turns into someting like https://comunidade.hostnet.com.br/logout?token=gRz9ckELZv4jTDY62si1XeCd5e6zStgaI0sYMoTe and screen shows an error 500.

That is my Flarum info:

comunidade@web160:~/www$ php8.0 flarum info
Flarum core: 1.8.9
PHP version: 8.0.30
MySQL version: 10.5.15-MariaDB-1:10.5.15+maria~focal-log
Loaded extensions: Core, date, libxml, openssl, pcre, zlib, filter, hash, json, pcntl, Reflection, SPL, session, standard, sodium, mysqlnd, PDO, xml, apcu, bcmath, bz2, calendar, ctype, curl, dom, mbstring, FFI, fileinfo, ftp, gd, gettext, gmp, iconv, igbinary, imagick, imap, intl, ldap, exif, memcache, msgpack, mysqli, oci8, pdo_dblib, pdo_mysql, pdo_pgsql, pgsql, Phar, posix, readline, shmop, SimpleXML, soap, sockets, sysvmsg, sysvsem, sysvshm, tokenizer, xmlreader, xmlrpc, xmlwriter, xsl, zip, memcached, redis, Zend OPcache
+------------------------------------------+---------+--------+
| Flarum Extensions                        |         |        |
+------------------------------------------+---------+--------+
| ID                                       | Version | Commit |
+------------------------------------------+---------+--------+
| flarum-flags                             | v1.8.2  |        |
| flarum-tags                              | v1.8.3  |        |
| flarum-approval                          | v1.8.2  |        |
| flarum-markdown                          | v1.8.1  |        |
| flarum-mentions                          | v1.8.5  |        |
| flarum-subscriptions                     | v1.8.1  |        |
| v17development-seo                       | v2.0.5  |        |
| askvortsov-rich-text                     | v2.1.7  |        |
| flarum-sticky                            | v1.8.2  |        |
| flarum-lock                              | v1.8.2  |        |
| fof-formatting                           | 1.0.3   |        |
| flarum-suspend                           | v1.8.4  |        |
| flamarkt-backoffice                      | 0.1.4   |        |
| afrux-forum-widgets-core                 | v0.1.7  |        |
| fof-follow-tags                          | 1.2.8   |        |
| flarumite-simple-discussion-views        | 1.2.4   |        |
| v17development-blog                      | v0.8.0  |        |
| v17development-user-badges               | v1.1.0  |        |
| sycho-profile-cover                      | v1.3.5  |        |
| sycho-lite-youtube                       | v0.1.1  |        |
| nodeloc-telegram                         | 0.3     |        |
| nearata-signup-confirm-password          | v3.1.1  |        |
| nearata-sensitive-content                | 1.1.0   |        |
| nearata-copy-code-to-clipboard           | v2.2.0  |        |
| kilowhat-wordpress                       | 2.0.2   |        |
| kilowhat-custom-paths                    | 1.9.0   |        |
| kilowhat-audit-free                      | 1.7.0   |        |
| justoverclock-welcomebox                 | 2.0.2   |        |
| justoverclock-username-blacklist         | 0.1.0   |        |
| justoverclock-staff-members-widget       | 0.1.3   |        |
| justoverclock-popular-tags               | 0.1.3   |        |
| justoverclock-discussion-info            | 0.1.5   |        |
| justoverclock-best-answer-badge          | 0.1.0   |        |
| justoverclock-be-active-user-indicator   | 0.1.0   |        |
| ianm-online-guests                       | 1.0.0   |        |
| ianm-log-viewer                          | 0.1.1   |        |
| ianm-follow-users                        | 1.4.11  |        |
| hazbin-rank-badges                       | v1.0.0  |        |
| fof-username-request                     | 1.2.4   |        |
| fof-user-bio                             | 1.4.2   |        |
| fof-upload                               | 1.6.1   |        |
| fof-profile-image-crop                   | 1.1.6   |        |
| fof-polls                                | 2.2.12  |        |
| fof-pages                                | 1.0.8   |        |
| fof-oauth                                | 1.6.16  |        |
| fof-merge-discussions                    | 1.4.1   |        |
| fof-linguist                             | 1.1.5   |        |
| fof-forum-statistics-widget              | 1.2.1   |        |
| fof-filter                               | 1.2.0   |        |
| fof-default-user-preferences             | 1.2.1   |        |
| fof-cookie-consent                       | 1.1.3   |        |
| fof-best-answer                          | 1.6.3   |        |
| fof-anti-spam                            | 1.1.3   |        |
| flarum-statistics                        | v1.8.1  |        |
| flarum-likes                             | v1.8.1  |        |
| flarum-lang-brazilian                    | 1.7.1   |        |
| flarum-extension-manager                 | v1.0.7  |        |
| flarum-emoji                             | v1.8.1  |        |
| ffans-clipboardjs                        | v1.0.0  |        |
| dem13n-topic-starter-label               | 0.1.8   |        |
| datlechin-simple-tour-guide              | v0.2.1  |        |
| datlechin-link-preview                   | v1.4.0  |        |
| datlechin-discussion-overview            | v0.3.0  |        |
| datlechin-copy-links                     | v1.0.1  |        |
| darkle-fancybox                          | 2.1.0   |        |
| club-1-cross-references                  | v1.1.1  |        |
| clarkwinkelmann-predefined-avatars       | 1.0.1   |        |
| clarkwinkelmann-popular-discussion-badge | 1.1.1   |        |
| clarkwinkelmann-no-email-notifications   | 1.0.0   |        |
| clarkwinkelmann-mailing                  | 1.1.0   |        |
| clarkwinkelmann-group-list               | 1.0.0   |        |
| clarkwinkelmann-emojionearea             | 1.0.0   |        |
| clarkwinkelmann-discussion-bookmarks     | 2.0.1   |        |
| clarkwinkelmann-auth-popup-failsafe      | 0.1.1   |        |
| blomstra-user-filter                     | 0.1.4   |        |
| blomstra-mark-unread                     | 0.2.0   |        |
| blomstra-fontawesome                     | 0.1.5   |        |
| askvortsov-moderator-warnings            | v0.6.3  |        |
| afrux-online-users-widget                | v0.1.9  |        |
+------------------------------------------+---------+--------+
Base URL: https://comunidade.hostnet.com.br
Installation path: /home/comunidade/www
Queue driver: sync
Session driver: file
Scheduler status: Inativo
Mail driver: smtp
Debug mode: off

Any hints or suggestions? Thanks.

luceos · 20 Feb

ivangneiding check storage/logs for any errors from flarum or your hosting plan webserver logs.

See https://docs.flarum.org/troubleshoot

ivangneiding · 11 Mar

I just realized the problem is being caused by the extension WordPress Integration. If I deactivate the extension, everything works fine.

@clarkwinkelmann, could you please help me out? The extension was working fine before. I don’t think the Flarum version is the cause of the problem because I rolled back, and the issue persists. I tried disabling and enabling the extension again, as well as creating and changing the API, but no luck. When I click to check the health status, it says everything is working fine.

huseyinfiliz · 11 Mar

ivangneiding Does the issue persist when you disable the SSO integration?

clarkwinkelmann · 12 Mar

I don't see enough information to help. If there is an error 500, please find the error message, either from Flarum log file or the webserver global error log https://docs.flarum.org/troubleshoot

The ?token= parameter in itself is a Flarum feature not specific to WP. It's usually visible when you try logging out with an expired CSRF token, you then see a confirmation button and after clicking the button, the token appears in the URL.

When using the WP extension you should in fact rarely ever see that token, because this part of the Flarum process is normally bypassed completely.

As for WP-related debugging, please check/confirm the following:

Is the Flarum user synced to a WP user, or is it a standalone Flarum user?
If the user is synced, is there a difference when logging out from Flarum or from WordPress?
When logging out, do you see the URL in the address bar being redirected between the WP and Flarum domains?

If you still have issues I can try creating an account on your website to check it out, but without the error from the log I probably won't be able to do much.

You can reach out through email (see extension documentation) if you would like to exchange details privately.

ivangneiding · 12 Mar

Hello. Thank you for responding.
huseyinfiliz When I disable the SSO functionality, the error stops occurring. However, this functionality is essential, and I need to keep it active.

clarkwinkelmann I apologize for the lack of information, but I’m not from the technical area and don’t have much knowledge to perform debugging; for example, most of the time, I can’t tell what the information in the logs represents.
I enabled debug mode and retrieved some log files (Flarum, PHP, and Apache). I would be grateful if you could review them and guide me on what I can do to resolve the issue. The files are available via Google Drive at this link.

This problem occurs both when I try to log out through Flarum and through the WordPress site; in both cases, the login redirects to the page shown in the info from the initial post, leaving the WordPress site and going to the Flarum site while adding the logout parameter to the URL.

The extension is configured to work with the WordPress site at https://academia.hostnet.com.br/ and is linked to my user (default actor); it has always been configured this way and was working correctly for a long time. The problem occurred suddenly.
The extension is configured as shown in the screenshots below:
Print 1
Print 2
Print 3
Thank you.

clarkwinkelmann · 12 Mar

ivangneiding I see there are 2 errors related to the Telegram extension in the log file, but I cannot tell if those happen during logout or at other times. Could you try logging out with the Telegram extension disabled?

The PHP log file only contains warnings and errors from August 2024, and the Apache log file only from September 2024. Are there no more recent logs available?

Apart from the Telegram error I'm not seeing anything helpful in the logs.

You can also try logging out while debug is set to true in config.php. A more detailed error message might appear directly on the page.

ivangneiding · 12 Mar

clarkwinkelmann thanks for your answer.
I really thought there might be a conflict with the Telegram extension because it was the last one installed with the purpose of handling registration/login, so I disabled it earlier to test, but without success. I retested now and disabled the Telegram extension (with debug mode active this time), but the error persisted.

Regarding the log files, these were the only ones I found, and there’s nothing more recent. I’ll add the Flarum log file to the folder I shared, containing the most recent messages, in case you need it ( I will name with "-NEW" ant end of file. When logging out with debug mode active, no messages are displayed, and all I can see is a 500 error message, as shown in this screenshot.

The same happens when we log out from the WordPress site, and the logout doesn’t actually occur, staying logged in directly.
[Edit] I found a log file named comunidade.hostnet.com.br-2025-03-12. I don't know if it is relevant, but I put in the same shared folder. And I also found a file named comunidade.hostnet.com.br-php.log that have more recent actions and something related to the extension.

clarkwinkelmann · 12 Mar

ivangneiding thanks, the error is indeed in the new files:

[12-Mar-2025 15:39:29 UTC] PHP Fatal error:  Declaration of Kilowhat\Wordpress\MD5UrlSigner::createSignature(string $url, string $expiration, string $signatureKey): string must be compatible with Spatie\UrlSigner\BaseUrlSigner::createSignature($url, string $expiration) in /home/comunidade/www/vendor/kilowhat/flarum-ext-wordpress/src/MD5UrlSigner.php on line 14

I think I made a mistake in my last update. I tried making my code compatible with both Spatie URL Signer v1 and v2, but apparently it's not working with v1 anymore.

If you are able to upgrade to PHP 8.1+, you can run composer update spatie/url-signer to upgrade to Spatie URL Signer v2 (it doesn't work with PHP 7 or 8.0). Or you can downgrade the WordPress integration to 2.0.1 to continue working with Spatie URL Signer v1.

I can try fixing compatibility with the v1 in a future release, but I'm not sure it's really worth the effort, it would be simpler to drop compatibility altogether but this will make my extension PHP8.1+ only.

ivangneiding · 12 Mar

clarkwinkelmann I upgraded PHP to version 8.2 and ran that command. Its working fine now thank you. The only "problem" is that now when we logout we are redirected to the Wordpress logout page and I would like to redirect to Flarum's main page, like it was before this problem. How can I do that?

clarkwinkelmann · 12 Mar

ivangneiding I don't think I changed the redirection logic recently. The intent is to always end up on the WP logout confirmation page after having been disconnected from both sides, no matter from which side the logout is triggered.

I would need to add a setting to customize this.

As things currently stand, if a WP plugin hooks into logout_redirect they will affect both the native logout and the Flarum global logout. I don't know which WP plugins exist to customize this value though.

ivangneiding · 12 Mar

clarkwinkelmann OK, I know how to achieve this in WordPress. Thank you very much for your support; I really appreciate the time you’ve taken to help me.