bugweb-cyradm - Bugs: bug #8793, Infinite Redirection Error

 
 

bug #8793: Infinite Redirection Error

Submitted by:  None
Submitted on:  Tue 04 May 2004 01:14:00 PM UTC  
 
Category: mainSeverity: 2 - Minor
Priority: 1 - LaterItem Group: normal bugs
Status: PostponedPrivacy: Public
Assigned to: NoneOriginator Name: Lobotomia
Originator Email: -unavailable-Open/Closed: Open
Release: 0.5.4Operating System: FreeBSD
Reproducibility: Every TimePlanned Release: 0.5.4
Cyrus IMAP version: 2.1.xPHP version: 4.3
Database type: MySQL 4.0

Add a New Comment (Rich MarkupRich Markup):
   

You are not logged in

Please log in, so followups can be emailed to you.

 

(Jump to the original submission Jump to the original submission)

Thu 04 Nov 2004 11:05:33 AM UTC, comment #6:

Note that same check exists in header.php, so you have to patch it there too.
-unavailable-

Anonymous
Thu 04 Nov 2004 11:00:36 AM UTC, comment #5:

The common cause is using symlink to web-cyradm directory in apache configuration, ie. you have
d /www/web-cyradm-0.5.4-1
l /www/web-cyradm -> /www/web-cyradm-0.5.4-1

and put "/www/web-cyradm" in httpd.conf

The guily is following piece of code in session.php

$ref=WC_BASE."/index.php";
if ($ref!=$_SERVER['SCRIPT_FILENAME']){
header("Location: index.php");

WC_BASE is defined as
define('WC_BASE', dirname(_FILE_));

dirname gives path after referencing symlink, while _SERVER[] contains path before referencing symlink - in above case - they don't match.

This is "so called" security feature mentioned in changelog

"Added new security feature, only referer WC_BASE/index.php is allowed to call subsequent pages"

solution
- don't use symlinks
- remove the check from session.php

-unavailable-

Anonymous
Thu 10 Jun 2004 10:53:23 PM UTC, comment #4:

I have just run in to the same problem with a tarball downloaded 06/09/2004. I've tried with apache2, mod_php4/5 on FreeBSD current.

Anonymous
Fri 28 May 2004 01:36:08 PM UTC, comment #3:

HEEELP the same problem ocurre even with the last CVS version 2004/05/28

Anonymous
Fri 21 May 2004 04:32:47 AM UTC, comment #2:

Yep same problem here, using Redhat 9, sendmail, apache1.3...

Anonymous
Thu 13 May 2004 03:31:40 PM UTC, comment #1:

I've got the same problem
FreeBSD 4.9, MySQL 4.0, Apache2, PHP4.3.x.

Any solution ?

-unavailable-

Anonymous
Tue 04 May 2004 01:14:00 PM UTC, original submission:

I have installed web-cyradm 0.5.4, I have create and edit config.php, when i try to connect to http://myserver/web-cyradm the browser (mozilla firefoxx or microsoft internet explorer) give me an error on maximum number of redirection.
How is possibile to resolve this problem?

Anonymous

 

(Note: upload size limit is set to 16384 kB, after insertion of the required escape characters.)

Attach File(s):
   
   
Comment:
   

No files currently attached

 

Depends on the following items: None found

Items that depend on this one: None found

 

CC list is empty

 

Do you think this task is very important?
If so, you can click here to add your encouragement to it.
This task has 0 encouragements so far.

Only logged-in users can vote.

 

Please enter the title of George Orwell's famous dystopian book (it's a date):

 

 

Follow 3 latest changes.

Date Changed By Updated Field Previous Value => Replaced By
Tue 30 Nov 2004 06:21:29 PM UTCdelouwSeverity3 - Normal=>2 - Minor
  Priority5 - Normal=>1 - Later
Tue 30 Nov 2004 06:20:54 PM UTCdelouwStatusNone=>Postponed

Back to the top


Powered by Savane 3.1-cleanup