From: Danilo B. <dan...@gm...> - 2008-11-20 12:33:48
|
Hi guys... Please, see my problem.... I have a SM with many domains and i use the virtual domains diferent than all people... My virtualhost conf in apache: ... * ServerName webmail.myssldomain.com.br ServerAlias webmail.** ... so...all my domains stay in only one SM install and i have one SSL... i am using the plugin show_ssl_link with this conf: $my_ssl_url = 'https://webmail.myssldomain.com.br/src/login.php'; $go_back_to_http_after_login = 1; When i access some domain like http://webmail.otherdomain.com the link SSL LOGIN go to https://webmail.myssldomain.com.br/src/login.php, the client access in https myssldomain.com.br, show the loading page and he is redirect come back to the http, in http://webmail.otherdomain.com with a login error. someone can help me ? Thanks -- Danilo Gonçalves Baio (dbaio) danilobaio (*) gmail . com danilobaio2 (*) gmail . com (44) 8801 1257 |
From: Paul L. <pa...@sq...> - 2008-11-20 19:44:12
|
On Thu, Nov 20, 2008 at 4:33 AM, Danilo Baio <dan...@gm...> wrote: > Hi guys... > > Please, see my problem.... > > I have a SM with many domains and i use the virtual domains diferent than > all people... > > > My virtualhost conf in apache: > > ... > ServerName webmail.myssldomain.com.br > ServerAlias webmail.* > ... > > so...all my domains stay in only one SM install and i have one SSL... > > i am using the plugin show_ssl_link with this conf: > > > $my_ssl_url = 'https://webmail.myssldomain.com.br/src/login.php'; > $go_back_to_http_after_login = 1; > > > > When i access some domain like http://webmail.otherdomain.com the link > SSL LOGIN go to https://webmail.myssldomain.com.br/src/login.php, the client > access in https myssldomain.com.br, show the loading page and he is redirect > come back to the http, in http://webmail.otherdomain.com with a login error. Show the error. Also, read the mailing list posting guidelines to see what system information you should post with your inquiry. > someone can help me ? Posting guidelines: http://squirrelmail.org/postingguidelines |
From: Danilo B. <dan...@gm...> - 2008-11-21 17:09:31
|
On Thu, Nov 20, 2008 at 5:44 PM, Paul Lesniewski <pa...@sq...>wrote: > On Thu, Nov 20, 2008 at 4:33 AM, Danilo Baio <dan...@gm...> wrote: > > Hi guys... > > > > Please, see my problem.... > > > > I have a SM with many domains and i use the virtual domains diferent than > > all people... > > > > > > My virtualhost conf in apache: > > > > ... > > ServerName webmail.myssldomain.com.br > > ServerAlias webmail.* > > ... > > > > so...all my domains stay in only one SM install and i have one SSL... > > > > i am using the plugin show_ssl_link with this conf: > > > > > > $my_ssl_url = 'https://webmail.myssldomain.com.br/src/login.php'; > > $go_back_to_http_after_login = 1; > > > > > > > > When i access some domain like http://webmail.otherdomain.com the > link > > SSL LOGIN go to https://webmail.myssldomain.com.br/src/login.php, the > client > > access in https myssldomain.com.br, show the loading page and he is > redirect > > come back to the http, in http://webmail.otherdomain.com with a login > error. > > Show the error. Also, read the mailing list posting guidelines to see > what system information you should post with your inquiry. > > > someone can help me ? > > Posting guidelines: http://squirrelmail.org/postingguidelines > > ------------------------------------------------------------------------- > This SF.Net email is sponsored by the Moblin Your Move Developer's > challenge > Build the coolest Linux based applications with Moblin SDK & win great > prizes > Grand prize is a trip for two to an Open Source event anywhere in the world > http://moblin-contest.org/redirect.php?banner_id=100&url=/ > ----- > squirrelmail-plugins mailing list > Posting guidelines: http://squirrelmail.org/postingguidelines > List address: squ...@li... > List archives: http://news.gmane.org/gmane.mail.squirrelmail.plugins > List info (subscribe/unsubscribe/change options): > https://lists.sourceforge.net/lists/listinfo/squirrelmail-plugins > Sorry... Server informations: SquirrelMail version:*1.4.6* Config file version:*1.4.0* PHP 5.2.6 - Apache 2.2.9 Slackware 12.1 Installed Plugins 1. todo 2. login_auto (1.1) 3. filters 4. mail_fetch 5. calendar 6. abook_take 7. squirrelspell 8. bookmarks 9. compatibility (2.0.13) 10. smallcal 11. delete_move_next 12. preview_pane 13. html_mail 14. newmail 15. check_quota 16. message_details 17. vlogin (3.8.0) 18. view_as_html 19. notes 20. msg_flags 21. translate 22. sent_subfolders 23. change_sqlpass 24. show_ssl_link (2.2) WEBSERVER: ServerName webmail.myssldomain.com.br ServerAlias webmail.* so...all my domains stay in only one SM install and i have one SSL... i am using the plugin show_ssl_link with this conf: $my_ssl_url = 'https://webmail.myssldomain.com.br/src/login.php'; $go_back_to_http_after_login = 1; When i access some domain like http://webmail.otherdomain.com the link SSL LOGIN go to https://webmail.myssldomain.com.br/src/login.php, the client access in https myssldomain.com.br, show the loading page and he is redirect come back to the http, in http://webmail.otherdomain.com with a login error. The ERROR: With $go_back_to_http_after_login = 1 http://webmail.otherdomain.com ---> Click SSL LOGIN ---> https://webmail.myssldomain.com.br/src/login.php ?do_secure_login=yes&orig_url=webmail.otherdomain.com Loading page in https://webmail.myssldomain.com.br... Redirect... So... show the error login in this link http://webmail.otherdomain.com/src/webmail.php and with $go_back_to_http_after_login = 0 http://webmail.otherdomain.com ---> Click SSL LOGIN ---> https://webmail.myssldomain.com.br/src/login.php ?do_secure_login=yes&orig_url=webmail.otherdomain.com LOGIN OK http://webmail.myssldomain.com.br/src/webmail.php Thanks.. -- Danilo Gonçalves Baio (dbaio) danilobaio (*) gmail . com danilobaio2 (*) gmail . com (44) 8801 1257 |
From: Paul L. <pa...@sq...> - 2008-11-21 20:02:36
|
>> > I have a SM with many domains and i use the virtual domains diferent than >> > all people... >> > >> > My virtualhost conf in apache: >> > >> > ... >> > ServerName webmail.myssldomain.com.br >> > ServerAlias webmail.* >> > ... >> > >> > so...all my domains stay in only one SM install and i have one SSL... >> > >> > i am using the plugin show_ssl_link with this conf: >> > >> > $my_ssl_url = 'https://webmail.myssldomain.com.br/src/login.php'; >> > $go_back_to_http_after_login = 1; >> > >> > When i access some domain like http://webmail.otherdomain.com the link >> > SSL LOGIN go to https://webmail.myssldomain.com.br/src/login.php, the client >> > access in https myssldomain.com.br, show the loading page and he is redirect >> > come back to the http, in http://webmail.otherdomain.com with a login error. >> >> Show the error. Also, read the mailing list posting guidelines to see >> what system information you should post with your inquiry. >> >> > someone can help me ? >> >> Posting guidelines: http://squirrelmail.org/postingguidelines > > Server informations: > > SquirrelMail version:1.4.6 You should upgrade IMMEDIATELY. 1.4.6. is ancient and full of known security holes. > Config file version:1.4.0 > PHP 5.2.6 - > Apache 2.2.9 > Slackware 12.1 > > Installed Plugins > 1. todo > 2. login_auto (1.1) > 3. filters > 4. mail_fetch > 5. calendar > 6. abook_take > 7. squirrelspell > 8. bookmarks > 9. compatibility (2.0.13) > 10. smallcal > 11. delete_move_next > 12. preview_pane > 13. html_mail > 14. newmail > 15. check_quota > 16. message_details > 17. vlogin (3.8.0) > 18. view_as_html > 19. notes > 20. msg_flags > 21. translate > 22. sent_subfolders > 23. change_sqlpass > 24. show_ssl_link (2.2) > > > WEBSERVER: > > ServerName webmail.myssldomain.com.br > ServerAlias webmail.* > > so...all my domains stay in only one SM install and i have one SSL... > > i am using the plugin show_ssl_link with this conf: > > $my_ssl_url = 'https://webmail.myssldomain.com.br/src/login.php'; > $go_back_to_http_after_login = 1; > > When i access some domain like http://webmail.otherdomain.com > the link SSL LOGIN go to https://webmail.myssldomain.com.br/src/login.php, the client access in https myssldomain.com.br, show the loading page and he is redirect come back to the http, in http://webmail.otherdomain.com with a login error. > > The ERROR: > > With $go_back_to_http_after_login = 1 > > http://webmail.otherdomain.com > ---> Click SSL LOGIN ---> > https://webmail.myssldomain.com.br/src/login.php?do_secure_login=yes&orig_url=webmail.otherdomain.com > > Loading page in https://webmail.myssldomain.com.br... > Redirect... > So... show the error login in this link > http://webmail.otherdomain.com/src/webmail.php > > and with $go_back_to_http_after_login = 0 > > http://webmail.otherdomain.com > ---> Click SSL LOGIN ---> > https://webmail.myssldomain.com.br/src/login.php?do_secure_login=yes&orig_url=webmail.otherdomain.com > > LOGIN OK > http://webmail.myssldomain.com.br/src/webmail.php Because the TLD is different between the SSL-enabled one and the regular one, the various SM cookies are probably getting set for the SSL-enabled one and so switching back to the other one results in not finding the needed cookies (watch them in your browser). The simple solution is to turn off $go_back_to_http_after_login. The more involved solution would be to re-engineer your Apache SSL design, which is left up to you. It is not technically possible for one domain to set cookies for another for obvious reasons. |