Re: [SM-USERS] Still problems with 1.4.19 and "you must be logged in" error

On Mon, Jun 8, 2009 at 2:30 AM, Rafael Martinez<[email protected]> wrote:
> [email protected] wrote:
> [....]
>>
>> When I  simply reconfigure httpd.conf to point to webmail-1.4.17 vice
>> webmail-1.4.19 and restart the httpd service all of the above problems go
>> away.
>>
>> I have not seen a response back to Rafael's email above yet and was
>> wondering what the status of this is and if there is something that can be
>> done to correct this. I am anxious to go back to 1.4.19 because of all of
>> the security fixes contained in 1.4.18 including the very important fix
>> regarding remote execution of server side code.
>>
>
> Hello
>
> We have found a way to avoid these problems.
>
> We have deleted this code in src/redirect.php:
>
> --------------------------------------------------------------------
> if (function_exists('session_regenerate_id')) {
>
>    session_regenerate_id();
>
>    // re-send session cookie so we get the right parameters on it
>    // (such as HTTPOnly, if necessary - PHP doesn't do this itself
>
>    sqsetcookie(session_name(),session_id(),false,$base_uri);
> }
> -------------------------------------------------------------------
>
> and this code in function/global.php:
>
> --------------------------------------------------------------------
>
> sqsetcookie(session_name(), $_COOKIE[session_name()], 1, $base_uri . 'src');
> sqsetcookie(session_name(), $_COOKIE[session_name()], 1, $base_uri .
> 'src/');
>
> --------------------------------------------------------------------
>
> Maybe some of the developers can explain the implications of these changes.

The session regeneration call prevents session fixation issues caused
by malicious cookies in the browser.  The call changes the session
name and tells PHP to transfer the current session data to that new
one.  Because you store your session data in a database, I suspect
this may be the problem.  You should provide more details about how
your session settings are configured in PHP.  Try watching the session
data for a given session and see if it correctly transfers the data
when a regenerate is called (you can create your own test page to do
that if you don't want to use SM).

The sqsetcookie() calls remove any cookies in the browser that were
set under the /src directory.  This should also prevent abuse by
malicious cookies in the browser and as far as I can see, this would
not prevent proper functioning.

> With these changes, users logged in squirrelmail under the upgrade will
> get the "you must be logged in" error, but everything will work without
> problems when they logg in again after this.
>
> It have been a nightmare since 1.4.19 was released knowing the version
> we had in production had serious security problems and not been able to
> upgrade.
>
> We are very disappointed  with the null respond from developers we have
> had on this issue.

Well, since you aren't paying for the product or the support and we're
doing what we can in our spare time to help you, I can't take this
kind of comment as anything but discouraging of me putting in any
effort into this at all.

-- 
Paul Lesniewski
SquirrelMail Team
Please support Open Source Software by donating to SquirrelMail!
http://squirrelmail.org/donations.php

------------------------------------------------------------------------------
-----
squirrelmail-devel mailing list
Posting guidelines: http://squirrelmail.org/postingguidelines
List address: [email protected]
List archives: http://news.gmane.org/gmane.mail.squirrelmail.devel
List info (subscribe/unsubscribe/change options): https://lists.sourceforge.net/lists/listinfo/squirrelmail-devel