[ postfixadmin-Bugs-3393643 ] squirrelmail plugin login error

[SourceForge.net <no...@so...>]

Bugs item #3393643, was opened at 2011-08-18 09:47
Message generated for change (Comment added) made by christian_boltz
You can respond by visiting: 
https://sourceforge.net/tracker/?func=detail&atid=937964&aid=3393643&group_id=191583

Please note that this message will contain a full copy of the comment thread,
including the initial issue submission, for this request,
not just the latest update.
Category: None
Group: v2.3.3
Status: Open
Resolution: None
Priority: 5
Private: No
Submitted By: Juri Gurjanov (mralone)
Assigned to: Nobody/Anonymous (nobody)
Summary: squirrelmail plugin login error

Initial Comment:
Hello.

Found a problem with squirrelmail plugin and postfixadmin - if I made changes in "Forwarding", "Auto Response" or "Change Password", then click "Sigh Out" and login again, I can't access "Forwarding", "Auto Response" or "Change Password" anymore due to "ERROR You must be logged in to access this page." 

I can reproduce this problem on Squrrelmail 1.4.21 and 1.4.22 with Postfixadmin 2.3.3 but can't reproduce on Squirrelmail 1.4.15

----------------------------------------------------------------------

>Comment By: Christian Boltz (christian_boltz)
Date: 2011-08-27 00:12

Message:
Giving only a linenumber as context is not really useful because it heavily
depends on the version ;-)
Please provide a "diff -u" (unified diff) patch.

That said: This issue might be a bug in squirrelmail itsself. Can you
report it to the squirrelmail developers, please (with the patch included)?
Then add a link to the squirrelmail bugreport here.

BTW: The path "plugins" and "plugins/" should be enough.
"plugins/postfixadmin" is in theory more secure (because other plugins
can't access the session cookie), but that's more a theoretical issue IMHO.

----------------------------------------------------------------------

Comment By: Juri Gurjanov (mralone)
Date: 2011-08-25 18:58

Message:
Actually, adding next code to line 389 in squirrelmail/functions/global.php
fix the problem.

        sqsetcookie(session_name(), $_COOKIE[session_name()], 1, $base_uri
. 'plugins/');
        sqsetcookie(session_name(), $_COOKIE[session_name()], 1, $base_uri
. 'plugins');
        sqsetcookie(session_name(), $_COOKIE[session_name()], 1, $base_uri
. 'plugins/postfixadmin');
        sqsetcookie(session_name(), $_COOKIE[session_name()], 1, $base_uri
. 'plugins/postfixadmin/');

Not sure, what folder you use to store session cookies.

----------------------------------------------------------------------

Comment By: Juri Gurjanov (mralone)
Date: 2011-08-25 18:14

Message:
According to my test, latest version w/o problem - 1.4.17.

----------------------------------------------------------------------

Comment By: Christian Boltz (christian_boltz)
Date: 2011-08-22 01:01

Message:
That sounds like a problem with the PHP session and/or session cookies.

It would be helpful if you can find out the exact squirrelmail version
that introduced the problem.
The squirrelmail changelog [1] mentions various session-related changes
for the 1.4.19 release, which sound like the best "candidate" for
introducing the problem you describe. 
Can you please tes/verifyt if
- 1.4.19 contains the bug you mentioned
- 1.4.18 works bug-free

Knowing this will hopefully help to find the bug. (It might as well be a
bug/regression in squirrelmail.)

[1]
http://squirrelmail.svn.sourceforge.net/viewvc/squirrelmail/branches/SM-1_4-STABLE/squirrelmail/doc/ChangeLog?revision=14139&view=markup

----------------------------------------------------------------------

Comment By: Juri Gurjanov (mralone)
Date: 2011-08-18 09:49

Message:
Forgot to say, that if I close browser window, and login again, I can
access plugin parts, until some changes were made.

----------------------------------------------------------------------

You can respond by visiting: 
https://sourceforge.net/tracker/?func=detail&atid=937964&aid=3393643&group_id=191583