The browser identification code that tries to prevent hackers identifies Firefox 3.7 Alpha 2 as a hack attempt. Please keep in mind that a fix will not rectify the behavior in all existing PGV sites that have this code. Keep this in mind before updating to this latest and greatest from Mozilla. The bug can be seen at https://sourceforge.net/tracker/index.php?func=detail&aid=2962985&group_id=55456&atid=634867
If you would like to refer to this comment somewhere else in this project, copy and paste the following link:
Tom,
you may be correct, but it still points to an issue in the way PGV validates browsers. My feeling is that it probably doesn't add much security, but may block valid users.
If you would like to refer to this comment somewhere else in this project, copy and paste the following link:
KJ:
I disagree. I've noticed quite a few examples of access attempts using buckshee browsers, followed by true hack attempts from the same IP address. That's what gets unknown browsers listed as not being legitimate.
If you want to pass this one through as a legitimate browser, you need to comment out line 128 in "includes/session_spider.php" (SVN 6879). I'm not going to do that on my site - I'm not prepared to support bleating users who're using experimental software.
If you would like to refer to this comment somewhere else in this project, copy and paste the following link:
The browser identification code that tries to prevent hackers identifies Firefox 3.7 Alpha 2 as a hack attempt. Please keep in mind that a fix will not rectify the behavior in all existing PGV sites that have this code. Keep this in mind before updating to this latest and greatest from Mozilla. The bug can be seen at https://sourceforge.net/tracker/index.php?func=detail&aid=2962985&group_id=55456&atid=634867
Probably going to be better to avoid 3.7 and wait for Firefox 4.0.
Tom,
you may be correct, but it still points to an issue in the way PGV validates browsers. My feeling is that it probably doesn't add much security, but may block valid users.
Point.
KJ:
I disagree. I've noticed quite a few examples of access attempts using buckshee browsers, followed by true hack attempts from the same IP address. That's what gets unknown browsers listed as not being legitimate.
If you want to pass this one through as a legitimate browser, you need to comment out line 128 in "includes/session_spider.php" (SVN 6879). I'm not going to do that on my site - I'm not prepared to support bleating users who're using experimental software.
I see your point. I am not about to make changes to my server, but appreciate you pointing out the line number.