See bug 3807 and 
http://cvs.horde.org/diff.php?r1=1.116.2.12&r2=1.116.2.13&f=imp%2Fredirect.php

OK, sorry. I'll try to be more specific:



In redirect.php is:



/* If we already have a session: */

if (isset($_SESSION['imp']) && is_array($_SESSION['imp'])) {

     /* Make sure that if a username was specified, it is the current

      * username. */

     if (($imapuser !== null && ($imapuser == $_SESSION['imp']['user'])) &&

         ($pass !== null && ($pass == 
Secret::read(Secret::getKey('imp'), $_SESSION['imp']['pass'])))) {



         /* Disable the old session. */

         unset($_SESSION['imp']);

         _redirect(Auth::addLogoutParameters(IMP::logoutUrl(), 
AUTH_REASON_FAILED));

     }



but it isn't correct, we should destroy old session and redirect to 
"failed" only when user or password in session are different than in 
$_POST, not when they are the same!

Why? What's the bug? And please post a unified diff instead of a code 
block, it's much clearer what you're changing that way.

In redirect.php should be:



     if (($imapuser !== null && ($imapuser !== $_SESSION['imp']['user'])) &&

         ($pass !== null && ($pass !== 
Secret::read(Secret::getKey('imp'), $_SESSION['imp']['pass'])))) {



         /* Disable the old session. */

         unset($_SESSION['imp']);

         _redirect(Auth::addLogoutParameters(IMP::logoutUrl(), 
AUTH_REASON_FAILED));

     }