Re: SQMTRASH being used in place of password (1.4.13)

On Jun 19, 2008, at 3:33 PM, Paul Lesniewski wrote:

> Well let us know if you find something we need to look at.



Well it appears I am still tracking this down.  It is appearing even  
more and more frequently now.

I've noticed this in a bunch of the ones that are getting the  
key=SQMTRASH.

[HTTP_COOKIE] => SQMSESSID=529d8084e9cf8cdf0e951ad3984b23f9;  
key=SQMTRASH; SQMSESSID=529d8084e9cf8cdf0e951ad3984b23f9; key=VtMywUw%3D

And further digging, and looking at the access logs shows it is only  
happening with IE (6/7) on both XP and Vista, and if I look at the  
http access logs I see their browser calling signoff.php with a  
referrer set to right_main.php.

So it looks like they are logging in correctly.  It starts to load,  
gets through right_main and then somehow the browser issues a request  
for signoff.php, and then we start getting the cookie with multiple  
values sharing the same keys, and it stops working.   Just clearing  
cookies doesn't seem to fix the problem either.  Need to clear Cookies/ 
Temp Internet Files / Caches.  And then it works fine..

Of course I have yet to be able to replicate the problem on any  
computer that I have access to. so ti makes debugging it troublesome..

Not sure where the problem lies, but since I detest M$ IE I will point  
the finger at it. since we haven't changed anything in a real long time.

We are getting ready to move to 1.4.15 (going to move it to testing).  
not sure if doing that is going to change anything.. but will let you  
know how we make out.

Thanks again.

-Patrick

--
Patrick Muldoon
Network/Software Engineer
INOC (http://www.inoc.net)
PGPKEY (http://www.inoc.net/~doon)
Key ID: 0x370D752C

/* Don't meddle in the affairs of sysadmins,
* for they are subtle and quick to anger.
*/


-------------------------------------------------------------------------
Check out the new SourceForge.net Marketplace.
It's the best place to buy or sell services for
just about anything Open Source.
http://sourceforge.net/services/buy/index.php
-----
squirrelmail-devel mailing list
Posting guidelines: http://squirrelmail.org/postingguidelines
List address: [email protected]
List archives: http://news.gmane.org/gmane.mail.squirrelmail.devel
List info (subscribe/unsubscribe/change options): https://lists.sourceforge.net/lists/listinfo/squirrelmail-devel