| Summary | HTTP/HTTPS login issue |
| Queue | IMP |
| Queue Version | 4.0.3 |
| Type | Bug |
| State | Not A Bug |
| Priority | 2. Medium |
| Owners | Horde Developers (at) |
| Requester | horde (at) padilla (dot) net |
| Created | 06/02/2005 (7405 days ago) |
| Due | |
| Updated | 06/06/2005 (7401 days ago) |
| Assigned | 06/02/2005 (7405 days ago) |
| Resolved | 06/06/2005 (7401 days ago) |
| Github Issue Link | |
| Github Pull Request | |
| Milestone | |
| Patch | No |
$conf['auth']['checkip'] to false.
would be too easy.
would be too easy.
State ⇒ Feedback
this pretty much defeats it, I think.
State ⇒ Assigned
--- ~/horde-3.0.4/lib/Horde/Auth.php Tue Mar 29 12:59:56 2005
+++ lib/Horde/Auth.php Thu Jun 2 08:00:17 2005
@@ -1080,7 +1080,10 @@
function _checkSessionIP()
{
return (empty($GLOBALS['conf']['auth']['checkip']) ||
- (isset($_SESSION['__auth']['remote_addr']) &&
$_SESSION['__auth']['remote_addr'] == $_SERVER['REMOTE_ADDR']));
+ (isset($_SESSION['__auth']['remote_addr']) &&
$_SESSION['__auth']['remote_addr'] == $_SERVER['REMOTE_ADDR']) ||
+ (isset($_SESSION['__auth']['remote_addr']) &&
$_SESSION['__auth']['remote_addr'] == $_SERVER['HTTP_CLIENT_IP']) ||
+ (isset($_SESSION['__auth']['remote_addr']) &&
$_SESSION['__auth']['remote_addr'] == $_SERVER['HTTP_X_FORWARDED_FOR'])
+ );
}
/**
State ⇒ Feedback
State ⇒ Unconfirmed
Priority ⇒ 2. Medium
Type ⇒ Bug
Summary ⇒ HTTP/HTTPS login issue
Queue ⇒ IMP
I have Horde/IMP set up for using HTTPS only for the part of the
session where the password is sent ($conf['use_ssl'] = 3;). I (client
side) am on a network that uses a transparent proxy for HTTP traffic,
so the HTTP and HTTPS source addresses that hit the server are
different.
I modified lib/Horde/Auth.php as follows (added checks for
HTTP_CLIENT_IP and HTTP_X_FORWARDED_FOR) and now it works fine:
function _checkSessionIP()
{
return (empty($GLOBALS['conf']['auth']['checkip']) ||
(isset($_SESSION['__auth']['remote_addr']) &&
$_SESSION['__auth']['remote_addr'] == $_SERVER['REMOTE_ADDR']) ||
(isset($_SESSION['__auth']['remote_addr']) &&
$_SESSION['__auth']['remote_addr'] == $_SERVER['HTTP_CLIENT_IP']) ||
(isset($_SESSION['__auth']['remote_addr']) &&
$_SESSION['__auth']['remote_addr'] == $_SERVER['HTTP_X_FORWARDED_FOR'])
);
}
Thanks for a great webmail client!
Len Padilla