Then you have to check if the password on the cookie is valid!
--------------------
This is the code to set the cookie on the master server
// Set magic cookie if login information is available
if (isset($_POST['save']) && isset($_POST['user']) && isset($_POST['pw'])) {
setcookie(
"MAGIC_COOKIE",
base64_encode("{$_POST['user']}:{$_POST['pw']}"),
time()+3600*24*12,
'/',
'.php.net'
);
list($user, $pw) = array($_POST['user'], $_POST['pw']);
}
-----------------
so, someone might set a cookie with the value of
base64_encode("didou:bogus_pass") and login sucessfully as you!
We surely need to check the password in the cookie!
As I have seen, the bugs and master machines have the user/pass DB, plus Wez's blog allows us to log in with our CVS users, so I guess he also has a copy of the password file. I cannot estimate the security conserns of giving out the password file for our server, we will discuss this with systems@ (also CC-ed). We would need the token for
http://master.php.net/fetch/cvspasswd.php
Goba