Re: SQMTRASH being used in place of password (1.4.13)

On Tue, Jun 24, 2008 at 5:23 PM, Patrick Muldoon <[email protected]> wrote:
> On Jun 19, 2008, at 3:33 PM, Paul Lesniewski wrote:
>
>> Well let us know if you find something we need to look at.
>
>
>
> Well it appears I am still tracking this down.  It is appearing even
> more and more frequently now.
>
> I've noticed this in a bunch of the ones that are getting the
> key=SQMTRASH.
>
> [HTTP_COOKIE] => SQMSESSID=529d8084e9cf8cdf0e951ad3984b23f9;
> key=SQMTRASH; SQMSESSID=529d8084e9cf8cdf0e951ad3984b23f9; key=VtMywUw%3D
>
> And further digging, and looking at the access logs shows it is only
> happening with IE (6/7) on both XP and Vista, and if I look at the
> http access logs I see their browser calling signoff.php with a
> referrer set to right_main.php.

You mean signout.php, right?

> So it looks like they are logging in correctly.  It starts to load,
> gets through right_main and then somehow the browser issues a request
> for signoff.php,

I don't recall anywhere in the code that there is any automatic
redirection to signout.php.  The user has to click the signout link,
although I have reproduced something similar once when doing debugging
of a not-yet-finished plugin that was incorrectly coded so that the
"right_frame" parameter was set to signout, but anyway, unless you are
running custom/broken code, that's probably unrelated.  Do note,
however, that some older SM versions had package compromises - if you
are running one such package, you should immediately start testing
your upgrade.

> and then we start getting the cookie with multiple
> values sharing the same keys, and it stops working.   Just clearing
> cookies doesn't seem to fix the problem either.  Need to clear Cookies/
> Temp Internet Files / Caches.  And then it works fine..
>
> Of course I have yet to be able to replicate the problem on any
> computer that I have access to. so ti makes debugging it troublesome..
>
> Not sure where the problem lies, but since I detest M$ IE I will point
> the finger at it. since we haven't changed anything in a real long time.
>
> We are getting ready to move to 1.4.15 (going to move it to testing).
> not sure if doing that is going to change anything.. but will let you
> know how we make out.

Thank you

-------------------------------------------------------------------------
Check out the new SourceForge.net Marketplace.
It's the best place to buy or sell services for
just about anything Open Source.
http://sourceforge.net/services/buy/index.php
-----
squirrelmail-devel mailing list
Posting guidelines: http://squirrelmail.org/postingguidelines
List address: [email protected]
List archives: http://news.gmane.org/gmane.mail.squirrelmail.devel
List info (subscribe/unsubscribe/change options): https://lists.sourceforge.net/lists/listinfo/squirrelmail-devel