bugProject Steve Guttenberg - Bugs: bug #3185, PHP session paths

 
 

bug #3185: PHP session paths

Submitted by:  Will Fischer <stratocaster>
Submitted on:  Thu 10 Apr 2003 10:47:12 PM UTC  
 
Category: AdministratonSeverity: 3 - Normal
Item Group: BugStatus: Fixed
Privacy: PublicAssigned to: Gavin Brown <jodrell>
Open/Closed: Closed

Add a New Comment(Rich Markup)
   

You are not logged in

Please log in, so followups can be emailed to you.

 

Fri 11 Apr 2003 01:03:35 PM UTC, comment #2:

PSG now puts the URI into the session, and checks for it in loggedin(). Works fine, as long as everyone upgrades ;)

Will Fischer <stratocaster>
Project Member
Fri 11 Apr 2003 11:47:22 AM UTC, comment #1:

This has something to do with the problem that sessions created with older versions of PSG aren't constrained, but the new version is. so if bob uses PSG < 1.8 and pete uses PSG >= 1.8, then bob can log into his blog and then go to pete's, but bob can't do the reverse.

so the solution is to put something unique into each session, like the script's URI on the server, into the session and check that in loggedin().

Gavin Brown <jodrell>
Project AdministratorIn charge of this item.
Thu 10 Apr 2003 10:47:12 PM UTC, original submission:

the new code to keep /~username from having access to /~username2 DOES NOT WORK.

Check http://eeek.org.uk/~stratocaster/psg/index.php

The only name in the $users array for this instance of PSG is "Will"

Will Fischer <stratocaster>
Project Member

 

(Note: upload size limit is set to 16384 kB, after insertion of the required escape characters.)

Attach File(s):
   
   
Comment:
   

No files currently attached

 

Depends on the following items: None found

Items that depend on this one: None found

 

CC list is empty

 

Do you think this task is very important?
If so, you can click here to add your encouragement to it.
This task has 0 encouragements so far.

Only logged-in users can vote.

 

Please enter the title of George Orwell's famous dystopian book (it's a date):

 

 

Follow 3 latest changes.

Date Changed By Updated Field Previous Value => Replaced By
Fri 11 Apr 2003 01:03:35 PM UTCstratocasterStatusNone=>(Error - Not Found)
  Open/ClosedOpen=>(Error - Not Found)
Fri 11 Apr 2003 11:38:14 AM UTCjodrellSummarymagic quotes thingy=>

Back to the top


Powered by Savane 3.1-cleanup1