bugweb-cyradm - Bugs: bug #8793, Infinite Redirection Error

 
 

bug #8793: Infinite Redirection Error

Submitted by:  None
Submitted on:  Tue 04 May 2004 01:14:00 PM UTC  
 
Category: mainSeverity: 2 - Minor
Priority: 1 - LaterItem Group: normal bugs
Status: PostponedPrivacy: Public
Assigned to: NoneOriginator Name: Lobotomia
Originator Email: -unavailable-Open/Closed: Open
Release: 0.5.4Operating System: FreeBSD
Reproducibility: Every TimePlanned Release: 0.5.4
Cyrus IMAP version: 2.1.xPHP version: 4.3
Database type: MySQL 4.0

Add a New Comment(Rich Markup)
   

You are not logged in

Please log in, so followups can be emailed to you.

 

(Jump to the original submission Jump to the original submission)

Thu 04 Nov 2004 11:05:33 AM UTC, comment #6:

Note that same check exists in header.php, so you have to patch it there too.
-unavailable-

Anonymous
Thu 04 Nov 2004 11:00:36 AM UTC, comment #5:

The common cause is using symlink to web-cyradm directory in apache configuration, ie. you have
d /www/web-cyradm-0.5.4-1
l /www/web-cyradm -> /www/web-cyradm-0.5.4-1

and put "/www/web-cyradm" in httpd.conf

The guily is following piece of code in session.php

$ref=WC_BASE."/index.php";
if ($ref!=$_SERVER['SCRIPT_FILENAME']){
header("Location: index.php");

WC_BASE is defined as
define('WC_BASE', dirname(_FILE_));

dirname gives path after referencing symlink, while _SERVER[] contains path before referencing symlink - in above case - they don't match.

This is "so called" security feature mentioned in changelog

"Added new security feature, only referer WC_BASE/index.php is allowed to call subsequent pages"

solution
- don't use symlinks
- remove the check from session.php

-unavailable-

Anonymous
Thu 10 Jun 2004 10:53:23 PM UTC, comment #4:

I have just run in to the same problem with a tarball downloaded 06/09/2004. I've tried with apache2, mod_php4/5 on FreeBSD current.

Anonymous
Fri 28 May 2004 01:36:08 PM UTC, comment #3:

HEEELP the same problem ocurre even with the last CVS version 2004/05/28

Anonymous
Fri 21 May 2004 04:32:47 AM UTC, comment #2:

Yep same problem here, using Redhat 9, sendmail, apache1.3...

Anonymous
Thu 13 May 2004 03:31:40 PM UTC, comment #1:

I've got the same problem
FreeBSD 4.9, MySQL 4.0, Apache2, PHP4.3.x.

Any solution ?

-unavailable-

Anonymous
Tue 04 May 2004 01:14:00 PM UTC, original submission:

I have installed web-cyradm 0.5.4, I have create and edit config.php, when i try to connect to http://myserver/web-cyradm the browser (mozilla firefoxx or microsoft internet explorer) give me an error on maximum number of redirection.
How is possibile to resolve this problem?

Anonymous

 

(Note: upload size limit is set to 16384 kB, after insertion of the required escape characters.)

Attach File(s):
   
   
Comment:
   

No files currently attached

 

Depends on the following items: None found

Items that depend on this one: None found

 

CC list is empty

 

Do you think this task is very important?
If so, you can click here to add your encouragement to it.
This task has 0 encouragements so far.

Only logged-in users can vote.

 

Please enter the title of George Orwell's famous dystopian book (it's a date):

 

 

Follow 3 latest changes.

Date Changed By Updated Field Previous Value => Replaced By
Tue 30 Nov 2004 06:21:29 PM UTCdelouwSeverity3 - Normal=>2 - Minor
  Priority5 - Normal=>1 - Later
Tue 30 Nov 2004 06:20:54 PM UTCdelouwStatusNone=>Postponed

Back to the top


Powered by Savane 3.1-cleanup1