(i moved this discussion to [EMAIL PROTECTED], because it has both english language and is relevant to development. the norwegians/skandinavians on the user list might not be interested.)
* Morten Arnesen ([EMAIL PROTECTED]) [040410 15:56]: > i ran a test on case 009 delete one user. > > the test concluded with error, deletion whithout adminpasswd. the session cookie i issue for saving the state lasts 5 minutes, just as the default of webmin's cookie which determines if one is logged in needs to authenticate newly. session cookies allow for this attack: admin logs in and authenticates. admin does GoodStuff. admin leaves website and place, browser still open. EvilGuy comes before webmin`s session cookie expires, hits the back button until he comes to the webmin page again and does EvilStuff. The session cookie belongs to the open webbrowser. it has nothing to do with leaving the webpage or so. we wont get rid of the webmin session cookie, it is part of webmin. how evil is it to use a WLUS session cookie for a similar purpose, and allowing for a similar attack?
