Huge Privacy and Security Problem!

phpVMS Legacy Support (v2/v5)
1

Hey everyone,

On our domain (afva.servegame.org) we have two different VMSs, one is our main one (afva.servegame.org/index.php and the other our new pacific counterpart (afva.servegame.org/pacific/index.php . If one pilot is logged in on one site and goes on the other they are logged in on that site they just went on as a different person!

More simple way:

Logged in: afva.servegame.org as AF0001 as ‘Example Guy’

Goes on : afva.servegame.org/pacific as PF0001 (auto login because already logged on the other site) as ‘Example Girl Smith’

This will cause massive problems on our vms,

can anyone help us???

Thanks

Mitch

On behalf of the AFVA Team

2

From looking at your pilots list im guessing this happens mostly with pilots numbered 0003/4 upwards, and not 1 or 2?

I’m not sure how your auto-login system works, but if each pilot had exactly the same number on the /pacific VMS then it may not cause such problems.

Perhaps if when registering on one, it registers on the other - then the userlists will be identical.

3

I’m not sure I understand. The cookie is specific to the domain but perhaps these fixes I’m making now to auth will fix the issue?

4

We are still having this problem.

From looking at your pilots list im guessing this happens mostly with pilots numbered 0003/4 upwards, and not 1 or 2?

I’m not sure how your auto-login system works, but if each pilot had exactly the same number on the /pacific VMS then it may not cause such problems.

Perhaps if when registering on one, it registers on the other - then the userlists will be identical.

Thanks for the replyYup thats correct, 1 and 2 are fine. We have not opened this part of the Airline so hopefully we can fix this before we do. How would we be able to register with Pacific at the same time when someone registers with the main airline?

Thanks,

Daryl

5

Try with the latest versions, the logins are db specific and cookies should be domain specific