session cross between users?

From: Date: Wed, 17 Nov 2004 11:47:23 +0000
Subject: session cross between users?
Groups: php.pear.general 
Request: Send a blank email to pear-general+get-15592@lists.php.net to get a copy of this message
Working with php5 in a multiuser application in some cases the sessions of these users interchange and the one screen is put to him vice versa to the other. It is a serious problem because it harms the security of the system. I'm not sure if is a problem of the configuration of php5 in the servant, of the source code, bug of php5, bug of pear package, etc. I have viewed the bug page of the Auth Package and I see: Session fixation attack vulnerability --------------------------------------- On successful authentication using supplied username and password, the session id should be changed. It would be nice to add an object option to allow setting this behavior. Can be my problem caused by this bug? I say to you what the system uses: Archive_Tar 1.2 stable Auth 1.2.3 stable Config 1.10.2 stable Console_Getopt 1.2 stable DB 1.6.8 stable DB_DataObject 1.7.2 stable DB_DataObject_FormBuilder 0.10.3 beta Date 1.4.3 stable File 1.0.3 stable HTML_Common 1.2.1 stable HTML_QuickForm 3.2.4 stable HTML_Table 1.5 stable HTML_TreeMenu 1.1.9 stable Image_Barcode 0.5 stable Log 1.8.6 stable PEAR 1.3.2 stable Translation 1.2.6pl1 stable XML_Parser 1.2.1 stable XML_RPC 1.1.0 stable XML_Util 0.6.1 stable Thanks Leo Márquez

« previous php.pear.general (#15592) next »