Tickets :: Comment on [#4005] redirect.php

* Your Email Address
* Spam protection	Enter the letters below: .___..__ __.. ..__ _/ [__)(__ \|\ \|[__) ./__.\| .__)\| \\|\|
Comment	> OK, sorry. I'll try to be more specific: > > > > In redirect.php is: > > > > /* If we already have a session: / > > if (isset($_SESSION['imp']) && is_array($_SESSION['imp'])) { > > / Make sure that if a username was specified, it is the current > > * username. / > > if (($imapuser !== null && ($imapuser == $_SESSION['imp']['user'])) && > > ($pass !== null && ($pass == > Secret::read(Secret::getKey('imp'), $_SESSION['imp']['pass'])))) { > > > > / Disable the old session. */ > > unset($_SESSION['imp']); > > _redirect(Auth::addLogoutParameters(IMP::logoutUrl(), > AUTH_REASON_FAILED)); > > } > > > > but it isn't correct, we should destroy old session and redirect to > "failed" only when user or password in session are different than in > $_POST, not when they are the same! > >
Attachment
Watch this ticket