[Tickets #4005] redirect.php - bug

[bugs@bugs.horde.org]

DO NOT REPLY TO THIS MESSAGE. THIS EMAIL ADDRESS IS NOT MONITORED.

Ticket URL: http://bugs.horde.org/ticket/?id=4005
-----------------------------------------------------------------------
 Ticket             | 4005
 Updated By         | maciej.niemir at ilim.poznan.pl
 Summary            | redirect.php - bug
 Queue              | IMP
 Version            | 4.1.1
 State              | Feedback
 Priority           | 1. Low
 Type               | Bug
 Owners             | 
-----------------------------------------------------------------------


maciej.niemir at ilim.poznan.pl (2006-06-05 11:37) wrote:

OK, sorry. I'll try to be more specific:

In redirect.php is:

/* If we already have a session: */
if (isset($_SESSION['imp']) && is_array($_SESSION['imp'])) {
    /* Make sure that if a username was specified, it is the current
     * username. */
    if (($imapuser !== null && ($imapuser == $_SESSION['imp']['user'])) &&
        ($pass !== null && ($pass == Secret::read(Secret::getKey('imp'),
$_SESSION['imp']['pass'])))) {

        /* Disable the old session. */
        unset($_SESSION['imp']);
        _redirect(Auth::addLogoutParameters(IMP::logoutUrl(),
AUTH_REASON_FAILED));
    }

but it isn't correct, we should destroy old session and redirect to "failed"
only when user or password in session are different than in $_POST, not when
they are the same!