Sign In Validation And Authentication Slow.

I have had the same sign in/authentication for a few months now without issue, but since today I cannot understand why its taking so long to complete. It takes so long that eventually I get this error:


Script timed out before returning headers: index.php

Here is the controller and model code:


		if (!Yii::app()->user->isGuest) {

			$this->redirect(array("site/"));

		}


		$sign_in = new SignIn;


		if (isset($_POST["SignIn"])) {

			$sign_in->attributes = $_POST["SignIn"];


			if ($sign_in->validate()) {

				$i = new UserIdentity($sign_in->username, $sign_in->password);


				if ($i->authenticate()) {

					if ($sign_in->remember_me) {

						Yii::app()->user->login($i, 60 * 60 * 24 * 30);

					} else {

						Yii::app()->user->login($i);

					}


					//AuthLog::in(); shouldn't call dynamic methods statically and vise versa

					$auth = new AuthLog;

					$auth->in();


					$this->redirect(Yii::app()->user->ReturnUrl);

				}

			}

		}


		$sign_in->username = null;

		$sign_in->password = null;


		$this->layout = "/layouts/box";


		$view = new stdClass();

		$view->models->sign_in = $sign_in;

		$this->render("sign_in", array("view" => $view));


<?php

/**

 * Class SignIn

 * @uses CFormModel

 */

class SignIn extends CFormModel

{

	public $username;

	public $password;

	public $remember_me;


	/**

	 * rules

	 *

	 * @access public

	 * @return array

	 */

	public function rules()

	{

		return array(

			array("password", "authenticate"),

			array("username, password, remember_me", "safe")

		);

	}

}


<?php

/**

 * Class UserIdentity

 * @uses CUserIdentity

 */

class UserIdentity extends CUserIdentity

{

	private $_id;


	/**

	 * getId

	 * Returns an ID

	 *

	 * @access public

	 * @return mixed|string

	 */

	public function getId()

	{

		return $this->_id;

	}


	/**

	 * authenticate

	 * Authenticates a user

	 *

	 * @access public

	 * @return bool

	 */

	public function authenticate()

	{

		$username = $this->username; // Set because "Username" is used in parent class

		$password = $this->password;


		$lower_user = strtolower($username);

		$hashed_pass = md5($password);

		$record_string = "lower(username) = '$lower_user' and password = '$hashed_pass' and status = 'active'";

		/** @var User $record */

		$record = User::model()->find($record_string);


		if (isset($record->company)) {

			$this->setState("company_id", $record->company->id);

			$this->setState("company_time_format", $record->company->time_format);

			$this->setState("company_timezone_name", $record->company->timezone->name);


			$auth_attributes = array(

				"userid" => $record->id

			);

			$auth_assignment = AuthAssignment::model()->findByAttributes($auth_attributes)->itemname;

			if ($auth_assignment == "super-admin") {

				$company = Company::model()->findAll();

				/** @var Company $company */

				$company = $company[0];

				$this->setState("company_id", $company->id);

				$this->setState("company_time_format", $company->time_format);

				$this->setState("company_timezone_name", $company->timezone->name);

			}


			// is the account settings are not completely filled, set this state

			if ($record->company->setup_account_settings == 'pending') {

				$this->setState("setup_account", true);

				$this->setState("setup_affiliate", true);

			}


			// if the user settings are not completely filled, set this state

			if ($record->company->setup_account_settings == 'step1') {

				$this->setState("setup_affiliate", true);

			}


			// if the user is still in setup, forward them to the plugin page

			/** @var APILog $apilog */

			$apilog = APILog::model()->find(APILog::model()->countCriteria($record->company->id));

			if (!$apilog->count) {

				$this->setState("setup_plugin", true);

			}


			if ($record->company->status != "active") {

				return false;

			}

			$this->_id = $record->id;

		}


		if ($record === null) {

			return false;

		} else {

			return true;

		}

	}

}

Id like to mention I havent ever had any issues before today and I am pretty much, as you can see, doing only the most basic of tasks.

Unless you’ve recently changed your code, I’d look elsewhere.

Did you restart the server? Sometimes a good idea.

Did you update the OS or any packages recently, automatically or manually? Might be an issue, again something a restart might fix.

Did you check resource usage on the server? Maybe some process is using all memory.

If you’ve covered those bases and haven’t changed your code, did the user database get spammed with a million new accounts?

Starting to clutch at straws… maybe you got hacked and are being used for a huge email campaign?

Sorry if I’m stating the obvious, but unless you changed your code, (and if you did that’s what you need to look at) it’s got to be something else.

While we’re here, I may be wrong but aren’t you leaving yourself open to SQL Injection here?:


$lower_user = strtolower($username);

                $hashed_pass = md5($password);

                $record_string = "lower(username) = '$lower_user' and password = '$hashed_pass' and status = 'active'";

                /** @var User $record */

                $record = User::model()->find($record_string);

EDIT: Almost forgot, look at your server logs (Apache?, PHP) and turn logging on in your config. Might give you some clues.