ispman/ispman-web/htdocs/admin index.cgi,1.14,1.15

Update of /cvsroot/ispman/ispman/ispman-web/htdocs/admin
In directory sc8-pr-cvs1.sourceforge.net:/tmp/cvs-serv6357/ispman-web/htdocs/admin

Modified Files:
	index.cgi 
Log Message:
fixed bug [ 940878 ] cleartext passwords saved in world readable files in /tmp
simply disabled session save.
since cookies expire at session end, there is no need to save the session anyway.

Index: index.cgi
===================================================================
RCS file: /cvsroot/ispman/ispman/ispman-web/htdocs/admin/index.cgi,v
retrieving revision 1.14
retrieving revision 1.15
diff -u -d -r1.14 -r1.15
--- index.cgi	14 Jan 2004 22:49:46 -0000	1.14
+++ index.cgi	1 May 2004 21:45:16 -0000	1.15
@@ -149,12 +149,15 @@
    $session->param("sessID" , time );
    $session->param("logintype" , $r->param("logintype") );
    $session->param("language" , $r->param("language") );
-   $session->save_param($r);
+# disabled session save because
+# a) cookie expires at session end, so no need for saving the session
+# b) security breach! password is saved in clear
+#   $session->save_param($r);
 }
 
 if ($r->param("language")) {
    $session->param("language" , $r->param("language") );
-   $session->save_param($r);
+#   $session->save_param($r);
 }
 
 



-------------------------------------------------------
This SF.Net email is sponsored by: Oracle 10g
Get certified on the hottest thing ever to hit the market... Oracle 10g. 
Take an Oracle 10g class now, and we'll give you the exam FREE.
http://ads.osdn.com/?ad_id=3149&alloc_id=8166&op=click