Re: SQMTRASH being used in place of password (1.4.13)

Patrick Muldoon wrote:
> 
> On Jun 19, 2008, at 3:33 PM, Paul Lesniewski wrote:
> 
>> Well let us know if you find something we need to look at.
> 
> 
> 
> Well it appears I am still tracking this down.  It is appearing even  
> more and more frequently now.
> 
> I've noticed this in a bunch of the ones that are getting the  
> key=SQMTRASH.
> 
> [HTTP_COOKIE] => SQMSESSID=529d8084e9cf8cdf0e951ad3984b23f9;  
> key=SQMTRASH; SQMSESSID=529d8084e9cf8cdf0e951ad3984b23f9; key=VtMywUw%3D
> 
> And further digging, and looking at the access logs shows it is only  
> happening with IE (6/7) on both XP and Vista, and if I look at the  
> http access logs I see their browser calling signoff.php with a  
> referrer set to right_main.php.
> 
> So it looks like they are logging in correctly.  It starts to load,  
> gets through right_main and then somehow the browser issues a request  
> for signoff.php, and then we start getting the cookie with multiple  
> values sharing the same keys, and it stops working.   Just clearing  
> cookies doesn't seem to fix the problem either.  Need to clear Cookies/ 
> Temp Internet Files / Caches.  And then it works fine..
> 
> Of course I have yet to be able to replicate the problem on any  
> computer that I have access to. so ti makes debugging it troublesome..
> 
> Not sure where the problem lies, but since I detest M$ IE I will point  
> the finger at it. since we haven't changed anything in a real long time.
> 
> We are getting ready to move to 1.4.15 (going to move it to testing).  
> not sure if doing that is going to change anything.. but will let you  
> know how we make out.
> 
> Thanks again.
> 

Try adding some parameters to signout link in functions/page_header.php

SquirrelMail creates link with
---
displayInternalLink ('src/signout.php', _("Sign Out"), $frame_top);
---

Add some get request arguments
---
displayInternalLink ('src/signout.php?dummy=dummy', _("Sign Out"),
$frame_top);
---

When you debug issue, make a list of all enabled IE BHOs, ActiveX addons and
internet accelerators installed on broken setup.

-- 
View this message in context: http://www.nabble.com/SQMTRASH-being-used-in-place-of-password-%281.4.13%29-tp18013016p18105582.html
Sent from the squirrelmail-devel mailing list archive at Nabble.com.


-------------------------------------------------------------------------
Check out the new SourceForge.net Marketplace.
It's the best place to buy or sell services for
just about anything Open Source.
http://sourceforge.net/services/buy/index.php
-----
squirrelmail-devel mailing list
Posting guidelines: http://squirrelmail.org/postingguidelines
List address: [email protected]
List archives: http://news.gmane.org/gmane.mail.squirrelmail.devel
List info (subscribe/unsubscribe/change options): https://lists.sourceforge.net/lists/listinfo/squirrelmail-devel