SquirrelMail

Hi,

We have the following server setup:
- Solaris 9
- Apache/2.2.4 (Unix) DAV/2 mod_ssl/2.2.4 OpenSSL/0.9.8e PHP/5.2.2
- Squirrelmail 1.4.11
- Plugins: aboook_import_export 1.1, avelsieve 1.9.4, quota_usage 1.3.1,
useracl 2.1


Squirremail runs behind a web proxy which does session and cookie
management. We use this proxy to authenticate and authorize remote users
for various applications.

When one clicks "Sign Out" on the Squirrelmail, then PHP terminates the
session and sends the following HTTP header to the browser (or in our case
to the proxy):

Set-Cookie: SQMSESSID=deleted; expires=Thu, 09-Nov-2006 13:34:48 GMT;
path=/

Unfortunately the proxy implementation ignores the old HTTP 1.0 cookie
expires option and does not delete the cookie. It only looks at the
'max-age' option:

RFC 2109 --> 10.1.2 Expires and Max-Age

Netscape's original proposal defined an Expires header that took a
date value in a fixed-length variant format in place of Max-Age:

Wdy, DD-Mon-YY HH:MM:SS GMT

Note that the Expires date format contains embedded spaces, and that
"old" cookies did not have quotes around values. Clients that
implement to this specification should be aware of "old" cookies and
Expires.

http://tools.ietf.org/html/rfc2109
http://de.wikipedia.org/wiki/HTTP-Cookie

The expires option is also not very reliable. What if the clock of the
remote system is some years behind?

The problem now ist, that the proxy sends the cookie SQMSESSID=deleted back
to Squirrelmail and Squirrelmail interprets this as a valid session. This
happened in our setup and many users which were logged in at the same time
had the session and preferences of another who logged out previously.

Proposed fix: In functions/global.php in the function

function sqsession_is_active() {
@session_start();
}

Capture the event when the Cookie PHPSESSID (or which name ever is
configured in config.php) contains the string "deleted" or something
different than the random session ID generated by PHP and do not treat it
as a valid session. I'm not sure if this fix should go down to the PHP
layer because already there this is already treatened as a valid session.

Bye
Bernd