Re: [rt-users] 3.8.x serious security issue with mixing sessions [SOLVED I think!]

2009-11-03 Thread Jesse Vincent
This patch doesn't solve the issue. People still get mixed sessions (test was done after deleting all sessions from sessions table and restarting apache). Hang on. is mod_cache caching more than the files marked static, never changes? Since this patch should stop RT from putting cookie headers

Re: [rt-users] 3.8.x serious security issue with mixing sessions [SOLVED I think!]

2009-11-02 Thread Jesse Vincent
Cache: no-cache but that will prevent caching at all. Seem to be no way to prevent caching cookies from application side. What's the current state of browser in-memory/on-disk caching with the Cache: no-cache header? The attached patch against 3.8.6 might be the right solution for you. I'd

Re: [rt-users] 3.8.x serious security issue with mixing sessions [SOLVED I think!]

2009-11-02 Thread Arkadiusz Miskiewicz
On Monday 02 of November 2009, Jesse Vincent wrote: Cache: no-cache but that will prevent caching at all. Seem to be no way to prevent caching cookies from application side. What's the current state of browser in-memory/on-disk caching with the Cache: no-cache header? The attached patch

Re: [rt-users] 3.8.x serious security issue with mixing sessions [SOLVED I think!]

2009-11-01 Thread Arkadiusz Miskiewicz
On Friday 30 of October 2009, Jesse Vincent wrote: On Fri, Oct 30, 2009 at 03:13:33PM +0100, Arkadiusz Miskiewicz wrote: On Friday 23 of October 2009, Arkadiusz Miskiewicz wrote: On Friday 23 of October 2009, Jesse Vincent wrote: I don't think I've ever seen this wtih RT, but I have seen

Re: [rt-users] 3.8.x serious security issue with mixing sessions [SOLVED I think!]

2009-10-30 Thread Arkadiusz Miskiewicz
On Friday 23 of October 2009, Arkadiusz Miskiewicz wrote: On Friday 23 of October 2009, Jesse Vincent wrote: I don't think I've ever seen this wtih RT, but I have seen it with other applications - the cause is _usually_ an HTTP proxy that's caching RT's pages. Do you have any sort of

Re: [rt-users] 3.8.x serious security issue with mixing sessions [SOLVED I think!]

2009-10-30 Thread Jesse Vincent
On Fri, Oct 30, 2009 at 03:13:33PM +0100, Arkadiusz Miskiewicz wrote: On Friday 23 of October 2009, Arkadiusz Miskiewicz wrote: On Friday 23 of October 2009, Jesse Vincent wrote: I don't think I've ever seen this wtih RT, but I have seen it with other applications - the cause is