Skip to Content.
Sympa Menu

devel - [sympa-dev] Re: critical session-handling problem in 6.0+ (bug #6979)

Subject: Developers of Sympa

List archive

Chronological Thread  
  • From: Adam Bernstein <address@concealed>
  • To: "address@concealed" <address@concealed>
  • Subject: [sympa-dev] Re: critical session-handling problem in 6.0+ (bug #6979)
  • Date: Tue, 14 Sep 2010 16:21:03 -0700

Oops, sorry, I should also say:

MySQL version 5.1.48

and the output of sympa_wizard.pl --check is:


******* Check perl for SYMPA ********

Checking for PERL version:
-----------------------------
your version of perl is OK (5.010001 >= 5.008)

Checking for REQUIRED modules:
------------------------------------------
perl module from CPAN STATUS
----------- --------- ------
Archive::Zip Archive-Zip OK (1.30 >= 1.05)
CGI CGI OK (3.43 >= 3.35)
DBD::mysql Msql-Mysql-modulesOK (4.016 >= 4.008)
DBI DBI OK (1.611 >= 1.48)
DB_File DB_FILE OK (1.82 >= 1.75)
Digest::MD5 Digest-MD5 OK (2.39 >= 2.00)
Encode Encode OK (2.35 >= 1.0)
FCGI FCGI OK (0.71 >= 0.67)
File::Copy::Recursive File-Copy-RecursiveOK (0.38 >= 0.36)
HTML::FormatText HTML-Format OK (2.04 >= 1.0)
HTML::StripScripts::Parser HTML-StripScripts-ParserOK (1.03 >= 1.0)
HTML::TreeBuilder HTML-Tree OK (3.23 >= 1.0)
IO::Scalar IO-stringy OK (2.110 >= 1.0)
LWP libwww-per OK (5.836 >= 1.0)
Locale::TextDomain libintl-perl OK (1.20 >= 1.0)
MHonArc::UTF8 MHonArc OK (2.6.16 >= 2.6.0)
MIME::Base64 MIME-Base64 OK (3.08 >= 3.03)
MIME::Charset MIME-Charset OK (1.008 >= 1.006.2)
MIME::EncWords MIME-EncWords OK (1.012 >= 1.010)
MIME::Lite::HTML MIME-Lite-HTML OK (1.23 >= 1.23)
MIME::Tools MIME-tools OK (5.428 >= 5.423)
Net::Netmask Net-Netmask OK (1.9015 >= 1.9015)
Template Template-ToolkitOK (2.22 >= 1.0)
Term::ProgressBar Term-ProgressBarOK (2.09 >= 2.09)
Time::HiRes Time-HiRes OK (1.9719 >= 1.29)
URI::Escape URI-Escape OK (3.30 >= 1.35)
XML::LibXML XML-LibXML OK (1.70 >= 1.0)

Checking for OPTIONAL modules:
------------------------------------------
perl module from CPAN STATUS
----------- --------- ------
AuthCAS AuthCAS was not found on this system.
-> Usage of this module: CAS Single Sign-On client libraries. Required if you configure Sympa to delegate web authentication to a CAS server.
-> Install module AuthCAS ? [n]
Crypt::CipherSaber CipherSaber OK (1.00 >= 0.50)
DBD::Oracle DBD-Oracle was not found on this system.
-> Usage of this module: Oracle database driver, required if you connect to a Oracle database.
-> Install module DBD::Oracle ? [n]
DBD::Pg DBD-Pg was not found on this system.
-> Usage of this module: PostgreSQL database driver, required if you connect to a PostgreSQL database.
-> Prerequisites: postgresql-devel and postgresql-server. postgresql should be running for make test to succeed
-> Install module DBD::Pg ? [n]
DBD::SQLite DBD-SQLite was not found on this system.
-> Usage of this module: SQLite database driver, required if you connect to a SQLite database.
-> Prerequisites: sqlite-devel. No need to install a server, the SQLite server code being provided with the client code.
-> Install module DBD::SQLite ? [n]
DBD::Sybase DBD-Sybase was not found on this system.
-> Usage of this module: Sybase database driver, required if you connect to a Sybase database.
-> Install module DBD::Sybase ? [n]
File::NFSLock File-NFSLock was not found on this system.
-> Usage of this module: required to perform NFS lock ; see also lock_method sympa.conf parameter
-> Install module File::NFSLock ? [n]
IO::Socket::SSL IO-Socket-SSL OK (1.33 >= 0.90)
Mail::DKIM Mail-DKIM OK (0.38 >= 0.36)
Net::LDAP perl-ldap OK (0.4001 >= 0.27)
Net::SMTP libnet OK (2.31 >= 1.0)
SOAP::Lite SOAP-Lite OK (0.712 >= 0.60)
Text::LineFold Unicode-LineBreakOK (1.000 >= 0.008)
Text::Wrap Text-Tabs+Wrap OK (2009.0305 >= 1.0)

On 9/14/2010 4:15 PM, Adam Bernstein wrote:
Hi Sympa team. We're almost done with the Sympa 5.3.4 -> 6.1b4 upgrade on
our development server, but have now run into a bug that brings our whole
upgrade plan to a total stop -- we cannot run the new Sympa until it's
fixed. I see it already listed in your bug database (#6979), with no
progress since it was reported, so I'm a little concerned. What can we do
to help get it fixed?

Our Apache server is restarted every night for log rotation, which means
that the first (or actually, second) person to login every day is going to
be terribly confused when someone else's session pops up in their browser.
The security implications are also serious.

For what it's worth, I have not yet been able to deliberately reproduce the
bug with any amount of logging in and out, deleting cookies, restarting
Apache, or deleting rows from the session_table. And yet, it happens
reliably every day, after the automated Apache restart around midnight. So
I'm not sure what the exact trigger conditions are.

Our environment is:
FreeBSD 8.0
Apache 2.2.15
Perl 5.10.1
Sympa 6.1b4

Looking forward to working with you on this.

thanks,
adam





Archive powered by MHonArc 2.6.19+.

Top of Page