Session left behind - not closed
irakli - June 19, 2009 - 23:26
| Project: | Token authentication |
| Version: | 6.x-1.1 |
| Component: | Code |
| Category: | bug report |
| Priority: | critical |
| Assigned: | irakli |
| Status: | closed |
Description
Something wrong with the session expiration code. It does not expire (Tried Chrome and FFX on OS-X) and can be serious security risk.
However, if I change manual session kill with session_destroy() function, it works like a charm (please see attached patch).
Can you please review?
Thanks.
#1
#2
Fixed in CVS. Waiting for the security team review to make a security patch release.
#3
Automatically closed -- issue fixed for 2 weeks with no activity.
#4
Unfortunately, have not heard back from the security team, so will be releasing as bug-fix, not security update. Better than nothing, I guess.
#5
Automatically closed -- issue fixed for 2 weeks with no activity.