Advanced search  

News:

cpg1.5.48 Security release - upgrade mandatory!
The Coppermine development team is releasing a security update for Coppermine in order to counter a recently discovered vulnerability. It is important that all users who run version cpg1.5.46 or older update to this latest version as soon as possible.
[more]

Pages: [1]   Go Down

Author Topic: Coppermine bridge problem  (Read 3179 times)

0 Members and 1 Guest are viewing this topic.

WGS_CyberDragon

  • Coppermine newbie
  • Offline Offline
  • Posts: 2
Coppermine bridge problem
« on: March 10, 2008, 03:54:42 pm »

I have installed Mambo and coppermine as clean installs but the user info will only port to coppermine if the 'remember me' box is ticked with mambo this works with any users.

Coppermine install: http://www.480racing.co.uk/Mambo/gallery
Forum install: http://www.480racing.co.uk/Mambo
Coppermine version: cpg1.4.16
Forum version: 4.6.2
Test user account: CyberDragon/mondeo01

BridgeManager settings:
Forum URL:  http://www.480racing.co.uk/Mambo
Relative path to your BBS's config file:  ../ 
Use post-based groups?:  1
Cookie name/preifx (if applicable): 480R
Logged

Joachim Müller

  • Dev Team member
  • Coppermine addict
  • ****
  • Offline Offline
  • Gender: Male
  • Posts: 47843
  • aka "GauGau"
    • gaugau.de
Re: Coppermine bridge problem
« Reply #1 on: March 11, 2008, 07:22:55 am »

Well, the "remember me" checkbox is something in mambo, isn't it? So you should modify mambo to have this checkbox always ticked and change the type from checkbox to "hidden", that should do the trick. You will need as well a link that points from your mambo page back to your gallery.
Logged

WGS_CyberDragon

  • Coppermine newbie
  • Offline Offline
  • Posts: 2
Re: Coppermine bridge problem
« Reply #2 on: March 11, 2008, 03:17:06 pm »

thanks for that but its not really viable or secure.  If someone using a public pc logs in and then someone else comes along the original users settings and session will still be logged in because the cookie is set to remember the user for a full year.

Also, that would not be a real fix but more of a back door fix.  There must be a way of doing this without the user hacing to have 'remember me' ticked in Mambo.  It has to have something to do with the way mambo.inc.php tries to read the session cookie then query it.  The value in mambo.inc never equals the value in the database unless remember me is ticked, in which case it uses a different cookie to do it.  I've tried setting the variable sessioncookie in mambo.inc to just about everything I can think of and monitoring the output and still neither ever come out the same.  I'm now at a total loss but know there must be a way I just find it without any help.
Logged
Pages: [1]   Go Up
 

Page created in 0.016 seconds with 15 queries.