By escoles on

I've recently had two very disturbing experiences, and excuse me if they're duplicates, but I'm not sure how to search for them:

  1. A very reliable and trustworthy user reported being suddently granted full access to all admin capability. This user doesn't normally have that level of access; what's more, she said she wasn't logged in at the time. I couldn't duplicate, so I theorized she might have been mistaken in what she saw, and perhaps been looking at a cached page showing her (more than garden variety) permissions.
  2. I looked at my site and found a comment from a visitor, attribted to me. This is quite odd, since anonymous comments are disabled.

Is this anything anyone recognizes? It's really, really disturbing to me -- "shut down the website right away" disturbing.

Comments

shrop’s picture

shrop commented

Which version of Drupal are you using?

escoles’s picture

escoles commented

Got myself into a hurry.

Some salient details:

  • Drupal version is 4.5.1. The only thing patched is the comment module. I can tell you what other modules are active if you need to know; the only one added recently is captcha.
  • Captcha module is currently installed. I'm about to disable it; the first episode I report occurred right after enabling it.
  • Comment.module was patched to enable the first versionf of the trackback spam filter.
  • The "me" id that showed up as the author of the post in question is NOT the root user -- it's user #2, which I created and use explicitly to avoid logging in with the root ID. It did (until a few minutes ago) have a very large number of permissions, though.
  • The mis-attributed post showed up while i was logged in (using Firefox) through a RoadRunner node in upstate NY; the post originated from somewhere in NYC. I don't have any reason to suppose that the person posting was intentionally trying to hack my site.

This stuff could have been going on forever, of course. But it's of particular interest right now because I've managed to annoy a bunch of people who are registering at my site. I'm inclined to let them have their say, but some of them are the unpleasant sort who'd tag you if they had a chance. I'd rather not give it to them.

tatonca’s picture

tatonca commented

... I couldn't tell you what is happening, but I thought I'd point this out ...

http://drupal.org/node/19651

~Tat~

escoles’s picture

escoles commented

Lots of food for thought in that thread. Seems plausible to suppose that it's due to a session ID being preserved in someone else's logfile.

Moral: Logout frequently to refresh your session.