[TYPO3-dev] Problem with RSAAuth extension

[Helmut Hummel]

Hi,

On 20.10.11 15:31, Zachary Davis wrote:
>>
>> So we accept this breaking change and the preformance problems instead
>> of fixing the session check properly in rsaauth? [1]
>
> Even if we check properly in rsaauth, we still have a problem. The real
> problem isn't rsaauth.

The problem that you cannot login into the backend with rsaauth enabled 
is the *wrong* check in rsaauth. Fixing the check, allows to log in again.

> The real problem is that index_ts.php writes data
> to $_SESSION without having called session_start. If session_start gets
> called later, that data (which, as I mentioned, may not even matter)
> gets lost.

The real problem is, that index_ts.php writes to $_SESSION for selecting 
a dummy timetrack object over a real one. This dummy object has been 
introduced for performance reasons.

So we accept a major performance impact to save some bits after it? This 
sounds very wrong to me.


Kind regards,
Helmut

-- 
Helmut Hummel
TYPO3 Security Team Leader, TYPO3 v4 Core Team Member

TYPO3 .... inspiring people to share!
Get involved: typo3.org