There is a security problem in the new script to authenticate users in our
site.
The problem is that register_globals is on in the master server, so I could
hack the script and login myself :)
Just do something like:
http://master.php.net/fetch/docsauth.php?_SERVER[REMOTE_ADDR]=**server_ip**&token=**token**&credential=a_magic_cookie
And you can use the script.
And the token shouldn't be a md5/sha hash?...
I've fixed the missing md5() around $_GET['token']). Also I've tested doing
something like http://server.name/phpinfo.php?_SERVER[REMOTE_ADDR]=127.0.0.1&toekn=testing&credentials=testing
to see if $_SERVER['REMOTE_ADDR'] changes when register globals is turned on
and it does not change, which is correct.
Depends on the order in which $_SERVER is set. If it is set after GET/POST/COOKIE, then noone should be able to trick it this way.
Goba