[bugs] [Bug 971] New - Logout does not destory session properly

[bugs@bugs.horde.org]

http://bugs.horde.org/show_bug.cgi?id=971

*** shadow/971	Wed Jun  5 00:54:07 2002
--- shadow/971.tmp.21306	Wed Jun  5 00:54:07 2002
***************
*** 0 ****
--- 1,31 ----
+ Bug#: 971
+ Product: Horde
+ Version: other
+ Platform: PHP Code
+ OS/Version: Solaris
+ Status: NEW   
+ Resolution: 
+ Severity: critical
+ Priority: P2
+ Component: IMP
+ Area: BUILD
+ AssignedTo: chuck@horde.org                            
+ ReportedBy: cameron_green@hotmail.com               
+ URL: 
+ Summary: Logout does not destory session properly
+ 
+ Hi,
+ 
+ After "logging out" of IMP 3.0, if I use the history to access the same session
+ it happily lets me go to the inbox and read/delete etc mail.
+ 
+ This is a huge security flaw.
+ I would like more information about this ASAP, as if it is a configuration
+ problem, I have been able to replicate this on random installations of IMP3.0 on
+ the web, so it is widespread.
+ 
+ Regards,
+ 
+ Cameron Green
+ c.greenNPSP@Mits.uq.edu.au
+