Bug #571

LiveUser::checkRight may succeed when not logged in

Details

Submitted	2004-01-13 19:29 UTC
From	jmikola at burgiss dot com
Assigned	lsmith
Status	Closed
Package	LiveUser
PHP Version	Irrelevant
OS	ANY
Roadmaps	(Not assigned)

Comments

[2004-01-13 19:29 UTC] jmikola at burgiss dot com

Description:
------------
this method, although understandably a wrapper for the perm container, does not affirm that the user is still logged in and/or $_auth is not null before proceeding to check the rights of the user. the logout() function only bothers to set $_auth to null when cleaning up. given that, it seems possible that the LoginManager could logout a user, but still check rights on him... which doesn't seem reasonable since, for all intents and purposes, logging out effectly shuts down most of the rest of the LoginManager... and if there's no user logged in anymore, there should no longer be an association with the old user's perm container (which was initialized with his user id).