Sorry, that last snippet should have read:

[snip] sub can_use_cgi_session { return 0; } [/snip]

--
Justin Simoni

: Dada Mail "Write Once - Distribute Everywhere" Email Communication
Software

url: http://mojo skazat com ph: 720 436 7701 aolim: leaddadaist

On May 18, 2006, at 5:00 PM, Dada Mail ((Justin Simoni)) wrote:

>

I got a report from a Dada Mail user that Dada Mail, 2 10 8 and
below comes with the CPAN perl module, CGI::Session The version
that comes with it, is in the 3 x series There seems to be some
security concerns with this version, some are described at:

http://bugs debian org/cgi-bin/bugreport cgi?bug=356555

The new alpha comes with a copy of CGI::Session (ver 4 13, the
most recent) that has these security problems fixed Now, here's
some problems with anyone that's not using the alpha version of
Dada Mail (I'm thinking the majority of you)

• CGI::Session 4 13 will not work with any version of Dada Mail,
  except the current 2 10 9 alpha version You'll need to upgrade, or:

• Install CGI::Session 4 13 and replace the, "dada/DADA/App/ Session pm file that comes with Dada Mail 2 10 9 alpha into your
  own working copy of Dada Mail This should relieve the problem,
  but hasn't been testing at all The easiest way to install
  CGI::Session 4 13 is to copy all the dada/DADA/perllib/CGI/Session*
  files from the Dada Mail 2 10 9 alpha distribution into your
  current installed copy

• If you cannot get this to work correctly, you can try just
  removing all the dada/DADA/perllib/CGI/Session* files Dada Mail
  fallback to a session system that does not rely on this CPAN module
  (handy, huh?)

• If the above doesn't work, open up dada/DADA/App/Session pm and
  find this method:

[snip]

sub can_use_cgi_session {

my $self = shift; my $can_use_cgi_session = 0;

if($] >= 5 006_001){
eval {require CGI::Session}; if(!$@){ $can_use_cgi_session = 1; } }

return $can_use_cgi_session; } [/snip]

Change it to:

[snip] can_use_cgi_session return 0; } [/snip]

• If you have Dada Mail, that has a version number below 2 9, you
  are unaffected

So, FYI - I don't have any live cases that the security issues
present in CGI::Session have caused any problems to any Dada Mail
user

Also, if you can test out the alpha, most notably with the login/ logout/logging into a different list and make sure all those still
work, it would help me greatly The program is only as good as the
feedback I get

Cheers,

-- Justin Simoni

: Dada Mail "Write Once - Distribute Everywhere" Email
Communication Software

url: http://mojo skazat com ph: 720 436 7701 aolim: leaddadaist

--

Post: dadadev@skazat com

Unsubscribe: http://mojo skazat com/cgi-bin/dada/mail cgi/u/dadadev/

List Information:

Archive: