mainSavannah Administration - Support: sr #105774, savannah login weird

 
 

sr #105774: savannah login weird

Submitter:  Peter Liscovius <peterdd>
Submitted:  Sat 17 Feb 2007 06:19:35 PM UTC
   
 
Category:  None Priority:  1 - Later
Severity:  3 - Normal Status:  None
Privacy:  Public Assigned to:  Beuc
Operating System:  None Open/Closed:  Closed
* Mandatory Fields

Add a New Comment Rich Markup
   

Thu 22 Feb 2007 05:16:15 PM UTC, comment #5: 

Hi.

Did you try with a newer Konqueror?

Sylvain Beucler <Beuc>
Sun 18 Feb 2007 12:18:24 PM UTC, comment #4: 

On Sun, Feb 18, 2007 at 06:59:37AM +0100, Peter Liscovius wrote:

> > I am using Konqueror 3.5.5 to type this reply.
> > I cannot reproduce the problem.
> >
> > The cookie test is performed when displaying the login form (using
> > redirections), not after you clicked the button, so your error is strange.
> The cookie_probe is set im konqueror 3.1.4 when I click on "Anmelden"(Login).
>
> > Is it possible for you try with this newer Konqueror version?
> Not at the moment. Maybe next week with a fresh burned knoppix. Idea: Is there
> some javascript involved in the redirection? In my case it is switched off by
> default.


No javascript is necessary. We want the website to be usable without JS.

> Sorry for not helping with ethereal tcpdump analysis, because I couldn't peek
> into the ssl-connection. ;-)
>
> On the other side: Why do you need a http(s) redirection for a cookie test???
> When clicking on "Anmelden/login" set a cookie, and when the user then login
> with username and password you will see/can test if there is sent this cookie
> back to server with the login request. So I don't understand why you need
> some extra redirection/make things complicate. And if login was successful
> the server sends back a cookie with the session key for that authenticated
> user and the user is logged in until session timeout or logout.


I used redirection to check the cookies settings before the user enters login/password.

Entering the password is password is tedious and you usually end up entering it trice with common websites (once: you get rejected because of no cookies; twice: you change the cookies settings and submit the form again but you didn't reload the page first, so the cookie probe is still not set; trice: so you get rejected to the login page again, but this sets the coookie probe this time, and you can type your login/password a 3rd time...).

By using redirection no user intervention / form submission is necessary to check the cookie availability.

That is, except that there's a problem in your case :)


> 2. The mailing list infos on http://savannah.gnu.org/mail/?group=..... seems
> to be unmaintained. It is my second project I browsed ever on savannah and on
> both (the first was gnash) there were/are  mailing list infos incomplete
> (missing mailing list now fixed on gnash) or have wrong links. So I asume
> there is some principle problem in maintaining mailing list info on the web
> site? (needs manually updates by project admins instead of an automatic?) 


In this case it's because sv-help-pub is an alias to sv-hackers. I fixed it. We renamed the mailing list but I kept the old sv-hackers real name to keep the archive links valid.

Mailing lists were managed differently through time, including manually, so sometimes this need to be fixed indeed.

Sylvain Beucler <Beuc>
Sat 17 Feb 2007 07:58:15 PM UTC, comment #3: 


> Hello Sylvain,
>
> it is Konqueror 3.1.4 and I hope the two screenshots help you. The problem
> with false alarm still exists.
>
> I cleaned all cookies before doing tests, so there were no older cookies saved
> in the browser.


I am using Konqueror 3.5.5 to type this reply.
I cannot reproduce the problem.

The cookie test is performed when displaying the login form (using redirections), not after you clicked the button, so your error is strange.

Is it possible for you try with this newer Konqueror version?

Sylvain Beucler <Beuc>
Sat 17 Feb 2007 06:25:30 PM UTC, comment #2: 

"When using a browser (namely konqueror) with some restricted cookie settings (sending cookie only to sending server) the login fails and the response claims that the cookies are set off in browser. But that is false alarm because it works perfectly on other sites which save the sessionid in cookies."

Can you give me the exact cookies settings so I can reproduce the issue?

Maybe that's because we register a domain-wide cookie (*.savannah.gnu.org).


"Further I dislike the default activation of autologin to other sites (savannah.nongnu.org) in the login form."

I activated it myself :) Because I use both gnu and nongnu. Anyway, both sites are hosted by the same hardware and shared the same database. No security risk involved.

Sylvain Beucler <Beuc>
Sat 17 Feb 2007 06:19:35 PM UTC, comment #1: 

This item has been reassigned from the project Savannah Administration task tracker to your tracker.

The original report is still available at task #6418

Following are the information included in the original report:

[field #0]                  Item ID: 6418
[field #1]                 Group ID: 5802
[field #2]              Open/Closed: Open
[field #3]                 Severity: 3 - Normal
[field #4]                  Privacy: Public
[field #8]                         : Unknown task Field Display Type
[field #9]                 Category: Approved Projects to be Reviewed
[field #10]             Submitted by: peterdd
[field #11]              Assigned to: None
[field #12]             Submitted on: Monday 01/22/2007 at 18:28
[field #13]                  Summary: savannah login weired
[field #14]      Original Submission: I don t know if that is the right place here, but I want to report a bug of savannah.gnu.org website and haven t found a better place yet.

When using a browser (namely konqueror) with some restricted cookie settings (sending cookie only to sending server) the login fails and the response claims that the cookies are set off in browser. But that is false alarm because it works perfectly on other sites which save the sessionid in cookies.

Further I dislike the default activation of autologin to other sites (savannah.nongnu.org) in the login form.

ps: Made duplicate entry in  gnu help wanted  because I m not sure where to post best for that topic.
[field #16]               Item Group: None
[field #17]                   Status: None
[field #18]        Component Version: None
[field #19]         Operating System: None
[field #20]          Reproducibility: None
[field #21]               Size (loc): None
[field #22]            Fixed Release: None
[field #23]          Planned Release: None
[field #24]                   Effort: 0.00
[field #28]                 Priority: 1 - Later
[field #29]          Should Start On: Monday 01/22/2007 at 01:00
[field #30]    Should be Finished on: Monday 01/22/2007 at 01:00
[field #31]         Percent Complete: 0%
[field #33]                  Release: None
[field #58]     Custom Select Box #1: None
[field #59]     Custom Select Box #2: None
[field #60]     Custom Select Box #3: None
[field #61]     Custom Select Box #4: None
[field #62]     Custom Select Box #5: None
[field #63]     Custom Select Box #6: None
[field #64]     Custom Select Box #7: None
[field #65]     Custom Select Box #8: None
[field #66]     Custom Select Box #9: None
[field #67]    Custom Select Box #10: None

Sylvain Beucler <Beuc>
Sat 17 Feb 2007 06:19:35 PM UTC, original submission:  

I don't know if that is the right place here, but I want to report a bug of savannah.gnu.org website and haven't found a better place yet.

When using a browser (namely konqueror) with some restricted cookie settings (sending cookie only to sending server) the login fails and the response claims that the cookies are set off in browser. But that is false alarm because it works perfectly on other sites which save the sessionid in cookies.

Further I dislike the default activation of autologin to other sites (savannah.nongnu.org) in the login form.

ps: Made duplicate entry in 'gnu help wanted' because I'm not sure where to post best for that topic.

Peter Liscovius <peterdd>

 

(Note: upload size limit is set to 16384 kB, after insertion of the required escape characters.)

Attach Files:
   
   
Comment:
   

No files currently attached

 

Depends on the following items: None found

Items that depend on this one: None found

 

Carbon-Copy List
  • -email is unavailable- added by Beuc (Updated the item)
  • -email is unavailable- added by peterdd (Submitted the item)
  •  

    There are 0 votes so far. Votes easily highlight which items people would like to see resolved in priority, independently of the priority of the item set by tracker managers.

    Only logged-in users can vote.

     

    Follow 4 latest changes.

    Date Changed by Updated Field Previous Value => Replaced by
    2007-03-23 Beuc Open/ClosedOpen Closed
    2007-02-17 Beuc Assigned toNone Beuc
        Summarysavannah login weired savannah login weird
    2007-02-17 Beuc Reassign itemSavannah Administration, task #6418 Savannah Administration, sr #105774

    Back to the top

    Powered by Savane 3.13-0329.
    Corresponding source code