There is a security problem in the new script to authenticate users in our
site.
The problem is that register_globals is on in the master server, so I could
hack the script and login myself :)
Just do something like:
http://master.php.net/fetch/docsauth.php?_SERVER[REMOTE_ADDR]=**server_ip**&token=**token**&credential=a_magic_cookie
And you can use the script.
You can use any of the manage scripts to check a magic cookie, and was able to do so in the past. But the problem you report can be easily fixed.
And the token shouldn't be a md5/sha hash?...
Already fixed by Jacques.
Goba