Re: SQMTRASH being used in place of password (1.4.13)

On Thu, Jun 19, 2008 at 12:18 PM, Patrick Muldoon <[email protected]> wrote:
> On Jun 19, 2008, at 3:06 PM, Paul Lesniewski wrote:
>
>>
>> Which one?  The one in src/redirect.php?  Where EXACTLY is the
>> password still OK and where does it get lost?  Exactly?
>>
>
> at like 47 right after it comes in the from user it is ok.
>
> By the time it calls sqimap_login in src/redirect, it has been changed
> to the SQMTRASH KEY as opposed to the encoded password.

sqimap_login uses $key, and not $secretkey, so do you mean that on
line 74/75 $secretkey has changed?  Seems to me there is not much room
for it to change.. you can comment out the do_hook() call to make sure
that is not a problem or disable all plugins.  The more likely
scenario is that there is a problem setting the cookie on line 97 and
that the login call(s) that happen after being redirected to
webmail.php are what fail.  This would indeed indicate a browser
cookie issue or some new issue we've not yet heard of in the code.


>
>>> come around.  SQMTRASH gets passed
>>> in as opposed to their encrypted key,  so when we go to decrypt it,
>>> it
>>> doesn't work.
>>>
>>> I am trying to track down exactly what is causing this, so any
>>> pointers would be helpful?
>>
>
>
>> If you grep the source, you'll see that that value is a placeholder
>> used to wipe the previous key out of existence when destroying the PHP
>> session.  This happens whenever there is a login failure as well as
>> any time the login page is visited.  Make sure there are not two users
>> using the same browser on the same computer, make sure there are not
>> two windows/tabs open in the same browser, one possibly pointing to
>> (reloading?) the login page.  Make sure your PHP session mechanism is
>> working normally, make sure the user browser works with cookies
>> correctly, etc.
>
>
> I've been digging and tracking, and it appears clearing the cookies on
> the browser fixes the issue.  The problem here is that I am 2 levels
> removed from talking to the actual person having the problem, and from
> what I can tell  they are your typical enduser, can't even tell us
> what browser they are using, etc.. or if they have multiple tabs,
> etc.. :)   And all of that information is getting filtered up through
> $standard_help_desk_tech.

fwrite($DEVNULL, $standard_help_desk_tech);

> I am guessing that it has to do with multiple browser windows or
> something odd in the cookie handling, since the people on the other
> end are swearing that they have shut off the computer, power cycled
> everything (including their DSL or Cablemodem) , just opened up the
> browser and typed their username/password and it doesn't work.  When
> they do this, I see the KEY=SQMTRASH in the cookies they are sending
> in. So I am guessing that for some reason their browser go confused.
>
> Since the clearing of cookies fixes it, I am not sure if it a SM issue
> or silly browser issue.

Well let us know if you find something we need to look at.

-------------------------------------------------------------------------
Check out the new SourceForge.net Marketplace.
It's the best place to buy or sell services for
just about anything Open Source.
http://sourceforge.net/services/buy/index.php
-----
squirrelmail-devel mailing list
Posting guidelines: http://squirrelmail.org/postingguidelines
List address: [email protected]
List archives: http://news.gmane.org/gmane.mail.squirrelmail.devel
List info (subscribe/unsubscribe/change options): https://lists.sourceforge.net/lists/listinfo/squirrelmail-devel