Security Issue - wrong user login after while or immediately

Dimitris Kerestetzis Posted in Beginning Developers 8 years ago

Hello,

Some users in my ossn platform make login and after while change their user profile!

For example... John Smith make login and after while or immediately change his profile to an other user in my ossn platform e.g. George Foo.

How can I check or what is maybe the problem here?

Thank you,
Dimitris

Replies
gr Fotis Grontas Replied 8 years ago

Dear Arsalan Shah, we believe that we have found the problem, it was in our server sessions.

We are moving in VPS on Monday, and we are continue the tests ( it appears to be solved by now, with the activation of OP cache in our server).

After the installation on VPS we will report if the problem has been solved or if it continues.

Thank you both very much for your quick response and help.

Kind Regards
Fotis Grontas

Indonesian Arsalan Shah Replied 8 years ago

I don't think the issue is related to OSSN because we are using OSSN on many platforms other than social network and none reported similar issue.

This can be for many reasons:

1.) MySQL didn't operating correctly.
2.) Your server mixing sessions.

If you tell your server details (just for our information) that would be good.

I suggest you to try on different server, please try it on VPS. If its appears on fresh VPS then you need to cooperate with us to debug the issue from our side and to fix it.

German Michael Zülsdorff Replied 8 years ago

Okay,
I was able to reproduce the issue almost every time with simultaneously logging in as

  1. Zet Mann on Win10 and Firefox
  2. Zet Frau on Ubuntu and Firefox

Most of the times I got Zet Frau wrongly displayed instead of Zet Mann on computer 1
which in a way makes sense to me because my Ubuntu is slightly faster and Zet Frau gets logged in first.

I was not able to reproduce it on zet.z-mans.net
most likely because this server is significantly slower (you may issue a "traceroute" command and see the difference)

Yeah, so I'm afraid we got some kind of race condition on your server, and I will forward this case to Arsalan who knows best how to track this problem down.

gr Fotis Grontas Replied 8 years ago

Dear Zet Man, we try it in zet.z-mans.net with the same way and everything was ok.

We try it in test.deepmind.gr (the exact same way) and we are having the same issue, all the times that we have make login at the same time.

Kind regards,

Fotis Grontas

gr Fotis Grontas Replied 8 years ago

Dear ZET MAN,

The cash was disabled

  1. The wrong member is not always the same, we are assuming that is always the one that makes login at the same time, regardless the physical distance ( e.g. from other cities)

  2. The php version is 5.6

  3. With the debug turned on there are no messages in the error_log file

We will add two test accounts in zet.z-mans.net and try the same think to see what happens.

We are really grateful for your help.

German Michael Zülsdorff Replied 8 years ago

Thanks, I'm beginning to understand ... :)

Do you have cache enabled on test.deepmind.gr ? If so, please disable and try to reproduce.

Feel free to add some test accounts at zet.z-mans.net. This is a fresh installed 4.2 too, with cache disabled. Is the issue reproducable on my machine?

And:
1. The wrong member you see: is it always the same one or any other random member of your community?
2. What PHP version are you running?
3. With debug turned on from Ossn admin panel - are there any messages in the error_log file?

gr Fotis Grontas Replied 8 years ago

Dear Zet Man, at first let me thank you for your quick reply.

"Three guys are sitting at 3 different computers with their browsers pointing to test.deepmind.gr
All three are clicking the "Login" button and are forwarded to test.deepmind.gr/login
All three are filling out their login credentials
All three are clicking the "Login" button simultaneously"

All the above are correct.

After the login, we are forwarded to test.deepmind.gr/home, but when we are clicking to open the sidebar in the left of the screen, then the other profile is appearing in the position of the original profile.

In the next action ( go back to home or refreshing the page) everything are going back to normal.

This phenomenon is repeated with the exact same way and in deepmind.gr with users from other cities, in the rush hours.

Kind regards,
Fotis Grontas

German Michael Zülsdorff Replied 8 years ago

Thanks Fotis for investigating. I still don't understand when it happens. So let me try to follow you step by step:

  1. Three guys are sitting at 3 different computers with their browsers pointing to test.deepmind.gr
  2. All three are clicking the "Login" button and are forwarded to test.deepmind.gr/login
  3. All three are filling out their login credentials
  4. All three are clicking the "Login" button simultaneously

Normally, they should be forwarded to test.deepmind.gr/home after successful login.
But on test.deepmind.gr/home there's nothing to show who you are!
So are what they doing next? Please tell us step by step.

Thanks.

gr Fotis Grontas Replied 8 years ago

Dear Zet Man hello again, we have locate the problem:

We have make a clean install of the last OSSN update in test.deepmind.gr and we have created three accounts in three different computers.

When we login at the same time, (3 different accounts in three separate computers) the one user sees the other one profile in his profile. After the first action (refresh or move into home page) the other profile is vanishing and change to the original profile.

The install is clean, the latest OSSN version.

Please advise.

Kind Regards,
Fotis Grontas

gr Fotis Grontas Replied 8 years ago

Dear Zet Man, I have send you and a message in your deepmind accounts.

The problem is appearing when we have many users to make login at the same time (or within a few minutes) and then someone can see in his profile an other users name and photo, but when the user click in his (changed) profile the profile returns in the original.

We have try it several times today, (differed accounts, with differed computers, and in differed locations) and when there are at the same time multiple logins (of differed users) at the same time or within minutes, this problem is appearing.

Please advise.

Kind Regards
Fotis Grontas