Mahara

  1. Bug #1385564
  2. Comment #1

Comment 1 for bug 1385564

Revision history for this message
Robert Lyon (robertl-9) wrote : Re: Can illegially access pages that contain a secret url by normal url

Further investigation into this problem:

What needs to happen is a user needs to access the secret url so that a cookie is set in the browser.

Then another user using the same browser session can access the page via the normal url.

This can happen in a school type situation where different people use the same machine.

To fix: have the secreturl cookies be killed on logout rather than closing of browser.