Breadcrumbs accessible on login page

tbrand

2008-05-01, 16:28 #1

Member for 2 weeks · 2 posts · Location: Toronto, Canada
Group memberships: Members

Show profile ·

Link to this post

Subject: Breadcrumbs accessible on login page

I haven't seen anybody mentioning this problem anywhere so I'm assuming that I must have done something wrong in the configuration.

When I connect to the dokuwiki server and get the login page the breadcrumbs from the previous session are still accessible which allows anybody to by-pass the login and access the server even if they are not set up as a valid user.

Any idea what I could be doing wrong?

Thank you.

ach 2008-05-03, 13:21 #2

Member since May 2006 · 99 posts
Group memberships: Members

Show profile ·

Link to this post

I do not know if I understand you correctly. But could mean something like this: http://forum.dokuwiki.org/thread/1186?

tbrand

2008-05-09, 05:08 #3

Member for 2 weeks · 2 posts · Location: Toronto, Canada
Group memberships: Members

Show profile ·

Link to this post

Thanks for the suggestion, ach, but I don't believe it is related to hidden directories.

This is what it seems to be going on:

* I access the dokuwiki server, get the login page and cannot do anything until I log in.
* I log in, get the start page, click on links, etc. While I access the various pages the trace links (breadcrumbs) appear in the top left corner.
* I log out and get back to the login page. But this time the breadcrumbs in the top left corner are still visible and what's worse they are active and allow me to access the dokuwiki pages without login in again.
* I quit my browser (and it does not seem to matter whether it is Firefox running on Linux or Windows or whether it is Microsoft IE), restart it, access the dokuwiki server and get back the login page with the active trace links still showing. When I click on the breadcrumbs I am allowed to access dokuwiki pages without having to login again.

I've experimented with it a little more and it seems to be related to the fact that I had the dokuwiki root directory configured as ``restricted'' in my apache server.
When I make the dokuwiki directory not restricted everything works exactly the way it should.

I now suspect that the problem may not have anything to do with dokuwiki but with php and the apache server.

Thanks for your help but I now think this may not be the right forum for this forum.