[1.7.1] sessionid in a URL=possible login visitor with the author's user account

[TheOracle]

I dont know what else to do to stop the session id from coming up in the link.

Well, if by re-installing 4images does not resolve the issue, you'd need to ask your ISP if the session.auto_start is set to off.

[pkitty]

if I reinstall, will I lose everything, like mods and stuff?

[TheOracle]

if I reinstall, will I lose everything, like mods and stuff?

No, not necessarely. Not if you make a backup of your actual content of 4images.

[pkitty]

Okay, will try it, gonna check my hosts support forum and see if anybody else is experiencing this problem. Thank you *hug* for your help and advice.

[Jan]

If you dont want to have session ids in you URLs, open includes/session.php and remove the following part:

Code: [Select]

    if ($this->mode == "get" && strpos($url, $this->session_id) === false) {
      $url .= strpos($url, '?') !== false ? $amp : "?";
      $url .= SESSION_NAME."=".$this->session_id;
    }
Note that after removing this, all users MUST have cookies enable to be able to login.

[TheOracle]

http://www.4homepages.de/forum/index.php?topic=9506.0

[JensF]

Is this working with 1.7, too???

[V@no]

Is this working with 1.7, too???

This issue was introduced in 4images v1.7.1 (or atleast I've never heard anyone reporting it before that)

The answer is no, v1.7 does not have this issue. In fact this "patch" is based on the method used in v1.7

[JensF]

If you dont want to have session ids in you URLs, open includes/session.php and remove the following part:

Code: [Select]

    if ($this->mode == "get" && strpos($url, $this->session_id) === false) {
      $url .= strpos($url, '?') !== false ? $amp : "?";
      $url .= SESSION_NAME."=".$this->session_id;
    }
Note that after removing this, all users MUST have cookies enable to be able to login.

is this the code fpr the 1.7 version???

Code: [Select]

if ($this->mode == "get" && !preg_match("/".SESSION_NAME."=/i", $url)) {
     $url .= preg_match("/\?/", $url) ? "$amp" : "?";
    $url .= SESSION_NAME."=".$this->session_id;
    }

[V@no]

no, you dont need this patch for v1.7, period.
Please pay attention to the headlines in "Bug Fixes" forum, if it only says [1.7] - its only for v1.7, if [1.7.1] - its only for v1.7.1 and if its [1.7 / 1.7.1] then its for both v1.7 and v1.7.1

[Gorbushka]

I've patched sessions.php, but sessionid still present in URL. What am i do wrong?

Code: [Select]

    if (!isset($this->session_info['session_user_id'])) {
        return false;
    }
    if (!isset($this->session_info['session_ip']) || (isset($this->session_info['session_ip']) && $this->session_info['session_ip'] != $this->user_ip))
        {
         session_regenerate_id();
        $this->session_id = session_id();
         return false;
         }
thanks.

[V@no]

This patch is not ment to remove sessionid in the url, it ment to prevent others loging with not their sessionid.
Sessionid in the url is a normal thing. Unless your cookies are blocked, it should only show sessionid first time you opened a page, after refresh it should be gone.

[tsimmons]

So, is there a fix available for 1.7.2 for the vulnerability suggested by Secunia? http://secunia.com/advisories/19908/ Or is 1.7.2 not really vulnerable?

Inquiring minds want to know ... 

[skunk]

thats about 1.7.1, what about 1.7.4 ? i cant find the lines where to patch.. and i need 2 remove the sessions from the urls .. what to do?
Thanks

[thunderstrike]

@skunk:

http://www.4homepages.de/forum/index.php?topic=8895.msg56542#msg56542