Re: session cross between users?
| From: | Justin Patrin | Date: | Wed, 17 Nov 2004 18:32:17 +0000 |
| Subject: | Re: session cross between users? | ||
| References: | 1 | Groups: | php.pear.general |
| Request: | Send a blank email to pear-general+get-15603@lists.php.net to get a copy of this message | ||
On Wed, 17 Nov 2004 12:47:23 +0100, Leo Márquez <leo@calidae.net> wrote:
> Working with php5 in a multiuser application in some cases the sessions of these users
> interchange
> and the one screen is put to him vice versa to the other. It is a
> serious problem because it harms the security of the system.
> I'm not sure if is a problem of the configuration of php5 in the servant, of the source
> code, bug of php5,
> bug of pear package, etc.
Are these users on different workstations or is this two people using
the same machine, one aftre the other?
> I have viewed the bug page of the Auth Package and I see:
>
> Session fixation attack vulnerability
> ---------------------------------------
> On successful authentication using supplied username and password, the
> session id should be changed. It would be nice to add an object option
> to allow setting this behavior.
>
> Can be my problem caused by this bug?
>
> I say to you what the system uses:
>
> Archive_Tar 1.2 stable
> Auth 1.2.3 stable
> Config 1.10.2 stable
> Console_Getopt 1.2 stable
> DB 1.6.8 stable
> DB_DataObject 1.7.2 stable
> DB_DataObject_FormBuilder 0.10.3 beta
> Date 1.4.3 stable
> File 1.0.3 stable
> HTML_Common 1.2.1 stable
> HTML_QuickForm 3.2.4 stable
> HTML_Table 1.5 stable
> HTML_TreeMenu 1.1.9 stable
> Image_Barcode 0.5 stable
> Log 1.8.6 stable
> PEAR 1.3.2 stable
> Translation 1.2.6pl1 stable
> XML_Parser 1.2.1 stable
> XML_RPC 1.1.0 stable
> XML_Util 0.6.1 stable
>
--
Justin Patrin