bugphpGroupWare - Bugs: bug #22763, strange domain set for session...

 
 

You are not allowed to post comments on this tracker with your current authentification level.

bug #22763: strange domain set for session cookies

Submitted by:  Olivier Berger <olberger>
Submitted on:  Fri 28 Mar 2008 04:01:28 PM UTC  
 
Item Group: SVN trunk (dev code)Category: API - phpGroupware API
Severity: 3 - NormalPriority: 5 - Normal
Status: In ProgressPrivacy: Public
Assigned to: NoneOpen/Closed: Open
Component Version: DEBOperating System: GNU/Linux - Debian
Reproducibility: Every TimePlanned Release: None
Fixed Release: 

Wed 02 Apr 2008 11:19:24 AM UTC, comment #1:

This won't be changed in 0.9.16, but has already been changed in the resight tree for trunk. The change should be included in the next sync - sorry not ETA

Dave Hall <skwashd>
Project Administrator
Fri 28 Mar 2008 04:01:28 PM UTC, original submission:

FYI, this is a forward of bug #421580 tracked in Debian BTS, with Dave's answer, about not using fqdn but parent domain in session cookies, which is a bug in the most generic case.

If the only justification is sitemanager, better fix sitemanager, then ;)

----- Forwarded message from Dave Hall <skwashd@phpgroupware.org> -----

>
> On Mon, 2007-04-30 at 10:37 +0200, Olivier Berger wrote:
> > Package: phpgroupware
> > Version: 0.9.16.011-3
> > Severity: normal
> >
> > Phpgroupware session cookies seem to get their domain set to the domain
> > instead of the fqdn...
> >
> > On a server like phpgroupware.mydomain.com, the cookies domain will be
> > '.mydomain.com'.
> >
> > I thinks this is not a generic setup which would match most installation
> > where several phpgroupware servers could be installed on the same
> > network and be isolated session-wide.
> >
> > Correct me if I'm wrong as I'm no expert in cookie specification.
>
> phpGroupWare attempts to set the cookie to the parent of the phpgw
> domain (usually .domain.tld) so sitemgr can be used for sites running on
> sub (or super) doamins of the phpgw hostname. It is kinda buggy as
> running phpgw on domain.com.au sets the cookie to .com.au which is a
> real problem.
>
> It is something on my "i will get to it one day list". If someone wants
> to submit a patch, I would propose the following:
>
> * setup - add cookie domain which defaults the parent of the current
> phpgw domain
>
> * the session classes use this value when setting the domain of cookies
>
> * the patch to developed for HEAD :)
>
> Cheers
>
> Dave

Olivier Berger <olberger>

 

No files currently attached

 

Depends on the following items: None found

Items that depend on this one: None found

 

Carbon-Copy List
  • -unavailable- added by skwashd (Posted a comment)
  • -unavailable- added by olberger (Submitted the item)
  •  

    Do you think this task is very important?
    If so, you can click here to add your encouragement to it.
    This task has 0 encouragements so far.

    Only logged-in users can vote.

     

    Please enter the title of George Orwell's famous dystopian book (it's a date):

     

     

    Follow 4 latest changes.

    Date Changed By Updated Field Previous Value => Replaced By
    Sat 06 Mar 2010 02:18:43 AM UTCskwashdAssigned toskwashd=>None
    Wed 02 Apr 2008 11:19:24 AM UTCskwashdItem Group0.9.16.012=>SVN trunk (dev code)
      StatusNone=>In Progress
      Assigned toNone=>skwashd

    Back to the top


    Powered by Savane 3.1-cleanup