Re: SQMTRASH being used in place of password (1.4.13)

On Jun 19, 2008, at 3:06 PM, Paul Lesniewski wrote:

>
> Which one?  The one in src/redirect.php?  Where EXACTLY is the
> password still OK and where does it get lost?  Exactly?
>

at like 47 right after it comes in the from user it is ok.

By the time it calls sqimap_login in src/redirect, it has been changed  
to the SQMTRASH KEY as opposed to the encoded password.


>> come around.  SQMTRASH gets passed
>> in as opposed to their encrypted key,  so when we go to decrypt it,  
>> it
>> doesn't work.
>>
>> I am trying to track down exactly what is causing this, so any
>> pointers would be helpful?
>


> If you grep the source, you'll see that that value is a placeholder
> used to wipe the previous key out of existence when destroying the PHP
> session.  This happens whenever there is a login failure as well as
> any time the login page is visited.  Make sure there are not two users
> using the same browser on the same computer, make sure there are not
> two windows/tabs open in the same browser, one possibly pointing to
> (reloading?) the login page.  Make sure your PHP session mechanism is
> working normally, make sure the user browser works with cookies
> correctly, etc.


I've been digging and tracking, and it appears clearing the cookies on  
the browser fixes the issue.  The problem here is that I am 2 levels  
removed from talking to the actual person having the problem, and from  
what I can tell  they are your typical enduser, can't even tell us  
what browser they are using, etc.. or if they have multiple tabs,  
etc.. :)   And all of that information is getting filtered up through  
$standard_help_desk_tech.

I am guessing that it has to do with multiple browser windows or  
something odd in the cookie handling, since the people on the other  
end are swearing that they have shut off the computer, power cycled  
everything (including their DSL or Cablemodem) , just opened up the  
browser and typed their username/password and it doesn't work.  When  
they do this, I see the KEY=SQMTRASH in the cookies they are sending  
in. So I am guessing that for some reason their browser go confused.

Since the clearing of cookies fixes it, I am not sure if it a SM issue  
or silly browser issue.

Thanks again,
-Patrick

--
Patrick Muldoon
Network/Software Engineer
INOC (http://www.inoc.net)
PGPKEY (http://www.inoc.net/~doon)
Key ID: 0x370D752C

"Pinky, you've left the lens cap of your mind on again."
- The Brain


-------------------------------------------------------------------------
Check out the new SourceForge.net Marketplace.
It's the best place to buy or sell services for
just about anything Open Source.
http://sourceforge.net/services/buy/index.php
-----
squirrelmail-devel mailing list
Posting guidelines: http://squirrelmail.org/postingguidelines
List address: [email protected]
List archives: http://news.gmane.org/gmane.mail.squirrelmail.devel
List info (subscribe/unsubscribe/change options): https://lists.sourceforge.net/lists/listinfo/squirrelmail-devel