[Phpgroupware-tracker] [Bug #3618] list_session function of class sessions_ph4 intrudes on other installations

[nobody]

=================== BUG #3618: LATEST MODIFICATIONS ==================
http://savannah.gnu.org/bugs/?func=detailbug&bug_id=3618&group_id=509

Changes by: Ralf Becker <address@hidden>
Date: Fri 05/16/2003 at 23:03 (Europe/Berlin)

            What     | Removed                   | Added
---------------------------------------------------------------------------
          Resolution | None                      | Works for me


------------------ Additional Follow-up Comments ----------------------------
It works in my testinstall: I only see the sessions of the domain I'm logged 
in. 

If you look at the Line 1050 of class.session_php4.inc.php: if the domain in 
the session-record does not match my own domain it does a continue to not list 
that record. To track down the prob. with your intall u might want to enable 
the debug-message on line 1055 extend with an additional output for 
$this->account_domain (the domain your in atm).

Let me know what is shows.



=================== BUG #3618: FULL BUG SNAPSHOT ===================


Submitted by: totschnig               Project: phpGroupWare                 
Submitted on: Thu 05/15/2003 at 04:16
Category:  API - Admin                Bug Group:  0.9.14.003 release        
Severity:  9 - Critical               Priority:  None                       
Resolution:  Works for me             Assigned to:  ralfbecker              
Status:  Open                         Component Version:  None              
Platform Version:  None               Reproducibility:  None                

Summary:  list_session function of class sessions_ph4 intrudes on other 
installations

Original Submission:  if there are several installations of phpgroupware on one 
system, and they use the same temp dir, and you view the active sessions, you 
can see the sessions of all installations there are on your system. You can 
even kill them!!!

Follow-up Comments
*******************

-------------------------------------------------------
Date: Fri 05/16/2003 at 23:03       By: ralfbecker
It works in my testinstall: I only see the sessions of the domain I'm logged 
in. 

If you look at the Line 1050 of class.session_php4.inc.php: if the domain in 
the session-record does not match my own domain it does a continue to not list 
that record. To track down the prob. with your intall u might want to enable 
the debug-message on line 1055 extend with an additional output for 
$this->account_domain (the domain your in atm).

Let me know what is shows.


CC list is empty


No files currently attached


For detailed info, follow this link:
http://savannah.gnu.org/bugs/?func=detailbug&bug_id=3618&group_id=509