Re[2]: [PEAR] session cross between users?

They are users from differents machines at same time. Thanks for the answer Leo Wednesday, November 17, 2004, 7:32:17 PM, vas escriure: JP> On Wed, 17 Nov 2004 12:47:23 +0100, Leo Márquez <leo@calidae.net> wrote: >> Working with php5 in a multiuser application in some cases the >> sessions of these users interchange >> and the one screen is put to him vice versa to the other. It is a >> serious problem because it harms the security of the system. >> I'm not sure if is a problem of the configuration of php5 in >> the servant, of the source code, bug of php5, >> bug of pear package, etc. JP> Are these users on different workstations or is this two people using JP> the same machine, one aftre the other? >> I have viewed the bug page of the Auth Package and I see: >> >> Session fixation attack vulnerability >> --------------------------------------- >> On successful authentication using supplied username and password, the >> session id should be changed. It would be nice to add an object option >> to allow setting this behavior. >> >> Can be my problem caused by this bug? >> >> I say to you what the system uses: >> >> Archive_Tar 1.2 stable >> Auth 1.2.3 stable >> Config 1.10.2 stable >> Console_Getopt 1.2 stable >> DB 1.6.8 stable >> DB_DataObject 1.7.2 stable >> DB_DataObject_FormBuilder 0.10.3 beta >> Date 1.4.3 stable >> File 1.0.3 stable >> HTML_Common 1.2.1 stable >> HTML_QuickForm 3.2.4 stable >> HTML_Table 1.5 stable >> HTML_TreeMenu 1.1.9 stable >> Image_Barcode 0.5 stable >> Log 1.8.6 stable >> PEAR 1.3.2 stable >> Translation 1.2.6pl1 stable >> XML_Parser 1.2.1 stable >> XML_RPC 1.1.0 stable >> XML_Util 0.6.1 stable >> -- Salutacions, Leo Márquez [ Enginyeria del software / Internet ] [ Calidae - www.calidae.com ]