Roundcube 1.3.4: Failing to log in

[pcrow]

I'm pretty sure I've got everything set up correctly, but it's not working.

I've added some echos and disabled the final redirect, which was wiping out any diagnostic messages. I can see that it's loading the regular login page and extracting the token, then doing the same post that the browser would normally do. But for some reason it's coming back with status 200 instead of 302. I know the username and password are correct.

It looks to me like it should be working, but I can't figure out why it's not getting the right result.

[pcrow]

I'm able to get it to work by changing two lines in roundcube/index.php:
at line 115:

    $auth = $RCMAIL->plugins->exec_hook('authenticate', array(
            'host'  => $RCMAIL->autoselect_host(),
            'user'  => trim(rcube_utils::get_input_value('_user', rcube_utils::INPUT_POST)),
            'pass'  => rcube_utils::get_input_value('_pass', rcube_utils::INPUT_POST, true, $pass_charset),
            'valid' => true, //$request_valid,
            'cookiecheck' => false, //true,
    ));

The last two lines are the key: I have to force 'valid' to true, and 'cookiecheck' to false. There should be a way to get this right without hacking the roundcube php (that breaks the upgrade process), and I'm not clear on what security issues I'm creating with bypassing those checks.

When I look at the roundcube sql log, I see two different session IDs when I use the auto-login, which suggests that it's generating one for the login page that is lost when it submits the form. Loading the login form does set a cookie when using a regular browser.

[mckaygerhard]

the problem is that RC 1.4 now send an id check. its like that part you see &_token=dB0repI9g0gCCdsyuOisO5x5UZuDihSD so this must mach of the generation pre send of the data.. previous releases of RC does not have that security part, also check #6 and #9 (comment)