bugphpGroupWare - Bugs: bug #22763, strange domain set for session...


You are not allowed to post comments on this tracker with your current authentication level.

bug #22763: strange domain set for session cookies

Submitter:  Olivier Berger <olberger>
Submitted:  Fri 28 Mar 2008 04:01:28 PM UTC
Category:  API - phpGroupware API Item Group:  SVN trunk (dev code)
Severity:  3 - Normal Priority:  5 - Normal
Status:  In Progress Privacy:  Public
Assigned to:  None Open/Closed:  Open
Component Version:  DEB Operating System:  GNU/Linux - Debian
Reproducibility:  Every Time Planned Release:  None
Fixed Release: 

Wed 02 Apr 2008 11:19:24 AM UTC, comment #1: 

This won't be changed in 0.9.16, but has already been changed in the resight tree for trunk.  The change should be included in the next sync - sorry not ETA

Dave Hall <skwashd>
Group administrator
Fri 28 Mar 2008 04:01:28 PM UTC, original submission:  

FYI, this is a forward of bug #421580 tracked in Debian BTS, with Dave's answer, about not using fqdn but parent domain in session cookies, which is a bug in the most generic case.

If the only justification is sitemanager, better fix sitemanager, then ;)

----- Forwarded message from Dave Hall <skwashd@phpgroupware.org> -----

> On Mon, 2007-04-30 at 10:37 +0200, Olivier Berger wrote:
> > Package: phpgroupware
> > Version:
> > Severity: normal
> >
> > Phpgroupware session cookies seem to get their domain set to the domain
> > instead of the fqdn...
> >
> > On a server like phpgroupware.mydomain.com, the cookies domain will be
> > '.mydomain.com'.
> >
> > I thinks this is not a generic setup which would match most installation
> > where several phpgroupware servers could be installed on the same
> > network and be isolated session-wide.
> >
> > Correct me if I'm wrong as I'm no expert in cookie specification.
> phpGroupWare attempts to set the cookie to the parent of the phpgw
> domain (usually .domain.tld) so sitemgr can be used for sites running on
> sub (or super) doamins of the phpgw hostname.  It is kinda buggy as
> running phpgw on domain.com.au sets the cookie to .com.au  which is a
> real problem. 
> It is something on my "i will get to it one day list".  If someone wants
> to submit a patch, I would propose the following:
> * setup - add cookie domain which defaults the parent of the current
> phpgw domain
> * the session classes use this value when setting the domain of cookies
> * the patch to developed for HEAD :)
> Cheers
> Dave

Olivier Berger <olberger>


(Note: upload size limit is set to 16384 kB, after insertion of the required escape characters.)

No files currently attached


Depends on the following items: None found

Items that depend on this one: None found


Carbon-Copy List
  • -email is unavailable- added by skwashd (Posted a comment)
  • -email is unavailable- added by olberger (Submitted the item)

    There are 0 votes so far. Votes easily highlight which items people would like to see resolved in priority, independently of the priority of the item set by tracker managers.


    Follow 4 latest changes.

    Date Changed by Updated Field Previous Value => Replaced by
    2010-03-06 skwashd Assigned toskwashd None
    2008-04-02 skwashd Item Group0.9.16.012 SVN trunk (dev code)
        StatusNone In Progress
        Assigned toNone skwashd

    Back to the top

    Powered by Savane 3.13-4b48.
    Corresponding source code