[horde] Session expiration when IP is changing

[Michael M Slusarz]

Quoting Anton Köstlbacher <horde3 at dingsbums.org>:

> Am 29.10.2013 21:50, schrieb Michael M Slusarz:
>> Quoting Michael M Slusarz <slusarz at horde.org>:
>>
>>> Quoting Anton Köstlbacher <horde3 at dingsbums.org>:
>>>
>>>> Hi,
>>>>
>>>> the behaviour when my dynamic IP address changes at midnight has
>>>> changed. I'm using Horde Groupware 5.1.2.
>>>>
>>>> I always had $conf[auth][checkip] enabled and it did log me out
>>>> correctly. Now AJAX requests are still executed (like refreshing the
>>>> mailbox pane), even after my IP changed. Horde only logs me out, when
>>>> I click on a link which reloads the page completly.
>>>>
>>>> Can anyone confirm this?
>>>
>>> Yes.  This commit broke all permission/authentication valid checks for
>>> AJAX (by broke I mean these no longer are done on an AJAX request):
>>>
>>> commit 9664382ee6550dd91db57c713de1b85bde630576
>>> Author: Ralf Lang <lang at b1-systems.de>
>>> Date:   Fri Aug 16 06:46:26 2013 +0200
>>>
>>>    fix broken unauthenticated calls for $_external handler methods
>>>    For all other handler methods, ajax.php does checking for the
>>> session key later on
>>>
>>> diff --git a/horde/services/ajax.php b/horde/services/ajax.php
>>> index 601fb9a..c8070ce 100644
>>> --- a/horde/services/ajax.php
>>> +++ b/horde/services/ajax.php
>>> @@ -30,7 +30,7 @@ if (empty($action)) {
>>> }
>>>
>>> try {
>>> -    Horde_Registry::appInit($app);
>>> +    Horde_Registry::appInit($app, array('authentication' => 'none'));
>>> } catch (Horde_Exception_AuthenticationFailure $e) {
>>>     $response = new
>>> Horde_Core_Ajax_Response_HordeCore_SessionTimeout($app);
>>>     $response->sendAndExit();
>>>
>>>
>>> There's a chicken/egg problem here, since we can't check whether the
>>> given AJAX action is an allowable non-authenticated action or not
>>> until Horde is initialized.
>>>
>>> I notice that RPC calls (rpc.php) uses a technique whereby they switch
>>> authentication state halfway through the script.  But that is VERY
>>> undesirable, since it requires the entire registry cache to be
>>> reinitialized (including autoloading), which is a heavy load for AJAX
>>> request - since most WILL require authentication.
>>>
>>> So we need a different solution.  I'm thinking we try to initialize
>>> the app with authentication.  If that fails, we fall back to a
>>> non-authenticated access.  Later, the latter will only allow calls to
>>> externally-defined AJAX requests or else it will error out.
>>
>> This is fixed with Horde 5.1.6/Horde_Core 2.11.0
>>
>> michael
>>
>> ___________________________________
>> Michael Slusarz [slusarz at horde.org]
>>
>
> Hi Michael,
>
> the problem still exists with Horde 5.1.5/Horde_Core 2.11.1. I would  
> consider this a quite severe security issue. What is your schedule  
> for the fix? Thanks in advance!

Works fine here.

michael

___________________________________
Michael Slusarz [slusarz at horde.org]