bugweb-cyradm - Bugs: bug #8793, Infinite Redirection Error

 
 

bug #8793: Infinite Redirection Error

Submitted by:  None
Submitted on:  Tue May 4 13:14:00 2004  
 
Category: mainSeverity: 2 - Minor
Priority: 1 - LaterItem Group: normal bugs
Status: PostponedPrivacy: Public
Assigned to: NoneOriginator Name: Lobotomia
Originator Email: -unavailable-Open/Closed: Open
Release: 0.5.4Operating System: FreeBSD
Reproducibility: Every TimePlanned Release: 0.5.4
Cyrus IMAP version: 2.1.xPHP version: 4.3
Database type: MySQL 4.0

Add a New Comment (Rich MarkupRich Markup):
   

You are not logged in

Please log in, so followups can be emailed to you.

 

(Jump to the original submission Jump to the original submission)

Thu Nov 4 11:05:33 2004, comment #6:

Note that same check exists in header.php, so you have to patch it there too.
-unavailable-

Anonymous
Thu Nov 4 11:00:36 2004, comment #5:

The common cause is using symlink to web-cyradm directory in apache configuration, ie. you have
d /www/web-cyradm-0.5.4-1
l /www/web-cyradm -> /www/web-cyradm-0.5.4-1

and put "/www/web-cyradm" in httpd.conf

The guily is following piece of code in session.php

$ref=WC_BASE."/index.php";
if ($ref!=$_SERVER['SCRIPT_FILENAME']){
header("Location: index.php");

WC_BASE is defined as
define('WC_BASE', dirname(_FILE_));

dirname gives path after referencing symlink, while _SERVER[] contains path before referencing symlink - in above case - they don't match.

This is "so called" security feature mentioned in changelog

"Added new security feature, only referer WC_BASE/index.php is allowed to call subsequent pages"

solution
- don't use symlinks
- remove the check from session.php

-unavailable-

Anonymous
Thu Jun 10 22:53:23 2004, comment #4:

I have just run in to the same problem with a tarball downloaded 06/09/2004. I've tried with apache2, mod_php4/5 on FreeBSD current.

Anonymous
Fri May 28 13:36:08 2004, comment #3:

HEEELP the same problem ocurre even with the last CVS version 2004/05/28

Anonymous
Fri May 21 04:32:47 2004, comment #2:

Yep same problem here, using Redhat 9, sendmail, apache1.3...

Anonymous
Thu May 13 15:31:40 2004, comment #1:

I've got the same problem
FreeBSD 4.9, MySQL 4.0, Apache2, PHP4.3.x.

Any solution ?

-unavailable-

Anonymous
Tue May 4 13:14:00 2004, original submission:

I have installed web-cyradm 0.5.4, I have create and edit config.php, when i try to connect to http://myserver/web-cyradm the browser (mozilla firefoxx or microsoft internet explorer) give me an error on maximum number of redirection.
How is possibile to resolve this problem?

Anonymous

 

(Note: upload size limit is set to 16384 kB, after insertion of the required escape characters.)

Attach File(s):
   
   
Comment:
   

No files currently attached

 

Depends on the following items: None found

Items that depend on this one: None found

 

CC list is empty

 

Do you think this task is very important?
If so, you can click here to add your encouragement to it.
This task has 0 encouragements so far.

Only logged-in users can vote.

 

Please enter the title of George Orwell's famous dystopian book (it's a date):

 

 

Follow 3 latest changes.

Date Changed By Updated Field Previous Value => Replaced By
Tue Nov 30 18:21:29 2004delouwSeverity3 - Normal=>2 - Minor
  Priority5 - Normal=>1 - Later
Tue Nov 30 18:20:54 2004delouwStatusNone=>Postponed

Back to the top


Powered by Savane 3.1-cleanup