Re: ANNOUNCE: SquirrelMail 1.4.20 Released
Paul Lesniewski <[email protected]>
| Newsgroups | gmane.mail.squirrelmail.devel |
|---|---|
| Message-ID | <[email protected]> |
On Tue, Mar 23, 2010 at 5:12 AM, Ralf Hildebrandt <[email protected]> wrote: > * Paul Lesniewski <[email protected]>: >> Greetings, >> >> The SquirrelMail Team is pleased to announce the release of >> SquirrelMail version 1.4.20. This release makes final the changes >> implemented in our last two release candidates and adds several >> smaller fixes and feature improvements. > > I'm observing a problems with the security_tokens line in the users' > *.pref files: > > Prior to login: > # grep security_tokens= ./6/f/hau-po.pref | wc > 1 1 618 > > After login & doing something & logging out: > # grep security_tokens= ./6/f/hau-po.pref | wc > 1 1 717 > > With each login the security_tokens= line grows longer! Why do you say that is a problem? It is designed as such. Technically, there isn't much reason not to just use a single token, but the original design was intended to be generic enough to allow one token per form served (to keep the attacker guessing). They are automatically culled when they expire. You can set more aggressive culling by setting $max_token_age_days to a small number (1 is fine, but keep in mind that if someone leaves, for example, a compose form open for more than one day, then tries to click Send, it will be rejected because the token expired) in config/config_local.php. -- Paul Lesniewski SquirrelMail Team Please support Open Source Software by donating to SquirrelMail! http://squirrelmail.org/donate_paul_lesniewski.php ------------------------------------------------------------------------------ Download Intel® Parallel Studio Eval Try the new software tools for yourself. Speed compiling, find bugs proactively, and fine-tune applications for parallel performance. See why Intel Parallel Studio got high marks during beta. http://p.sf.net/sfu/intel-sw-dev ----- squirrelmail-devel mailing list Posting guidelines: http://squirrelmail.org/postingguidelines List address: [email protected] List archives: http://news.gmane.org/gmane.mail.squirrelmail.devel List info (subscribe/unsubscribe/change options): https://lists.sourceforge.net/lists/listinfo/squirrelmail-devel