bugphpGroupWare - Bugs: bug #1171, admin authentication security hole

 
 

You are not allowed to post comments on this tracker with your current authentication level.

bug #1171: admin authentication security hole

Submitted by:  None
Submitted on:  Tue 10 Sep 2002 12:33:02 PM UTC  
 
Item Group: 0.9.14 releaseCategory: API - Setup
Severity: 4 - ImportantPriority: 7 - High
Status: FixedPrivacy: Public
Assigned to: Dave Hall <skwashd>Open/Closed: Closed
Component Version: NoneOperating System: Other
Reproducibility: Every TimePlanned Release: None
Fixed Release: 

Thu 20 Mar 2003 08:40:57 PM UTC, comment #2:

This has been corrected in CVS.

To grab a complete update of all fixes:

1) Check to see if you have cvs installed: 'cvs --help'.
1a) If not, install a copy of cvs-cli from your favorite
distro.

2) Then just type:
'cd <your phpgroupware dir>; cvs update -dP'.

You can do step 2 as many times in a day as you wish, and
will always get the most current bug fixes.

Thanks,

Dave Hall <skwashd>
Project AdministratorIn charge of this item.
Thu 20 Mar 2003 04:03:14 AM UTC, comment #1:

I have fixed this ... just awaiting test results

Dave Hall <skwashd>
Project AdministratorIn charge of this item.
Tue 10 Sep 2002 12:33:02 PM UTC, original submission:

RE: Authentication for config/setup and header admin broken

"logout" of either admin screen allows you to hit back button on browser, then refresh the admin screen and it logs you back in giving full privs without prompting for password.

Also it doesn't matter that you have two different passwords for the admin screens. Once logged into either one, you can go to the other without authenticating by entering the URL.

This is a major security hole.

Anonymous

 

No files currently attached

 

Depends on the following items: None found

Items that depend on this one: None found

 

CC list is empty

 

Do you think this task is very important?
If so, you can click here to add your encouragement to it.
This task has 0 encouragements so far.

Only logged-in users can vote.

 

Please enter the title of George Orwell's famous dystopian book (it's a date):

 

 

Follow 7 latest changes.

Date Changed By Updated Field Previous Value => Replaced By
Thu 20 Mar 2003 08:40:57 PM UTCskwashdStatusNone=>(Error - Not Found)
  Open/ClosedOpen=>(Error - Not Found)
Thu 20 Mar 2003 04:03:14 AM UTCskwashdAssigned toseek3r=>NA
  Summaryadmin authentication broken=>
Tue 26 Nov 2002 09:14:04 AM UTCskwashdSeverity3 - Normal=>(Error - Not Found)
Tue 10 Sep 2002 11:57:14 PM UTCskwashdCategoryAPI - Admin=>(Error - Not Found)
  Assigned toNone=>NA

Back to the top


Powered by Savane 3.1-cleanup1