Login error problem

2000-11-12 Thread Eddie Lau
Hi all, In the previous mail (Get Wrong Session?) I have mentioned a problem that few users of my web community login with their user name and password, they will go to other user's account. I have added a print LOG to the main page of each user's account. After few days monitor and get the

Re: (patch) tainted session_id fixed

2000-11-12 Thread Gerald Richter
> > found it. and it did only turn up in 1.0, not 1.5. > > even though the previous validation check failed and recreate_id was > set, it was still trying to use the given session_id > Yes, you are right Thanks for the fix Gerald

Re: EmbPerlFilter ...

2000-11-12 Thread Gerald Richter
Hi, > > I can't found EmbPerlFilter, is possible that you make a re-post to this list ? > Try http://forum.swarthmore.edu/epigone/modperl/grandjagren/38AB4BD6.53607315@gk g.net Gerald - Gerald Richterecos electronic communicatio

(patch) tainted session_id fixed

2000-11-12 Thread Angus Lees
On Mon, Nov 13, 2000 at 02:19:58PM +1100, Angus Lees wrote: > manually modifying the cookie still gives me the same taint and > internal server error > (i'm using Apache::Session 1.0, btw. i don't think i've mentioned that > earlier) found it. and it did only turn up in 1.0, not 1.5. even though

Re: trying to DeleteSession (security bug?)

2000-11-12 Thread Angus Lees
On Fri, Nov 10, 2000 at 09:28:41AM +0100, Gerald Richter wrote: > I have finished the session stuff so far (make test now works also). It in > the cvs. I would be happy if you could take a look at it and give me a > feedback if it works for you too. manually modifying the cookie still gives me th