Session [entered password] can be poisoned (remove heavy use of the $_SESSION variable)

Wow, this is a pretty terrible problem. It could also happen in the situation where a piece of content is previewed or saved (or even when the "Delete" button is clicked) and then you later go and modify a *completely* different node through admin/content/node or Views Bulk Operations. You very well could accidentally changes passwords on a ton of nodes all at once.

The use of $_SESSION is completely unnecessary and should be removed entirely.

It seems to work without the $_SESSION['_protected_node']['entered_password']

Making a note here, mainly. I'm not too sure I understand what you mean by "poisoned," but I'll look into how to remove all those $_SESSION. I think that the only one "necessary" is the one that representing a cookie so we know that a user entered the password. All the others are probably not necessary.

Thank you.
Alexis

Alright, all $_SESSION's are gone except the one to mark that a password was entered (since we need to attach that to each specific user.)

Let me know if you like this version better.

Thank you.
Alexis Wilke