Index: openacs-4/packages/acs-core-docs/www/security-notes.html =================================================================== RCS file: /usr/local/cvsroot/openacs-4/packages/acs-core-docs/www/security-notes.html,v diff -u -r1.47 -r1.48 --- openacs-4/packages/acs-core-docs/www/security-notes.html 11 Dec 2010 23:36:32 -0000 1.47 +++ openacs-4/packages/acs-core-docs/www/security-notes.html 27 Oct 2014 16:39:25 -0000 1.48 @@ -1,12 +1,12 @@ -Security Notes
Alex logo
Prev Chapter 14. Kernel Documentation Next

Security Notes

By Richard Li

+Security Notes
Alex logo
Prev Chapter 15. Kernel Documentation Next

Security Notes

By Richard Li

OpenACS docs are written by the named authors, and may be edited by OpenACS documentation staff.

The security system was designed for security. Thus, decisions requiring trade-offs between ease-of-use and security tend to result in a system that may not be as easy to use but is more secure. -

HTTPS and the sessions system

+

HTTPS and the sessions system

If a user switches to HTTPS after logging into the system via HTTP, the user must obtain a secure token. To insure security, the only way to @@ -27,7 +27,7 @@ if { [ad_secure_conn_p] && ![ad_login_page] } { set s_token_cookie [ns_urldecode [ad_get_cookie "ad_secure_token"]] - if { [empty_string_p $s_token_cookie] || [string compare $s_token_cookie [lindex [sec_get_session_info $session_id] 2]] != 0 } { + if { $s_token_cookie eq "" || $s_token_cookie ne [lindex [sec_get_session_info $session_id] 2]} { # token is incorrect or nonexistent, so we force relogin. ad_returnredirect "/register/index?return_url=[ns_urlencode [ad_conn url]?[ad_conn query]]" }