Zikula Community

• dits
  
  

  • Rank: Developer
  • Registered: Feb 17, 2005
  • Last visit: May 21, 2010
  • Posts: 684

  Posted: Feb 19, 2007 - 12:42 AM

  I have a user that came to me with the following:
  
  She was logged in and started a new topic. Before submitting - in a different tab - she logged out, and logged back in. When she tried to submit she got a _PNFORUM_NOAUTH error.
  
  Is there a way to change this behavior? Is anything being stored in the session? When is the permission check being done?

  • 
  •  
• **unknown user**
  
  

  • Rank: Senior
  • Registered: Mar 16, 2002
  • Last visit: Oct 21, 2009
  • Posts: 2330

  Posted: Feb 22, 2007 - 04:43 AM

  This is expected behavior and part of the security of PostNuke. Your best bet is to explain to the client that this is security-related and necessary to ensure the security and integrity of the site.
  
  If a logout occurs during a time when there is data being entered into another browser or tab, that data should be cut/pasted into a 'fresh' form, or it will not work.
  
  It is HIGHLY not recommended to attempt altering this, especially in a forum or comments module, where spam bots are most likely to launch an attack.
  
  It's easier to explain the implications to the client than it is to recover from malicious activity that may be inadvertently let in.
  
  :)

  • 
  •  
• dits
  
  

  • Rank: Developer
  • Registered: Feb 17, 2005
  • Last visit: May 21, 2010
  • Posts: 684

  Posted: Feb 22, 2007 - 07:30 AM

  Thanks for your comment alarconcepts. I was thinking along the same lines.
  
  However quickly browsing over the code of pnForum it seemed to me that quite some low level stuff is being done in the pnForum module bypassing the standard API. That made (/makes) me curious ...

  • 
  •  
•  
•  

Users on-line

• mazdev,
• mesteele101

This list is based on users active over the last 60 minutes.