Nathyn
Joined: 25 Sep 2005
Posts: 7341
Location: The Great Satan
|
| Posted: Sat Sep 16, 2006 5:16 pm Post subject: Forum security: Stop showing me my session ID. |
|
|
A while ago, the forum was hacked or something, right? Well, somebody needs to see if they can mask our session IDs. When I select a forum from the drop-down box at the bottom, when it re-directs me, it shows my session ID. So, it would look something like this:
http://www.politicalcrossfire.com/forum/viewforum.php?f=46&sid=284929a938c0f90238593249c9d09ef
(That number's fake, by the way. It's not my real session ID. I just made it up. Clicking on it will probably give an error.)
Anyway, in the past, I've seen my session ID pop up when viewing threads and forums too. If somebody copies and pastes the link at the top, accidentally copying and pasting their session ID, then there's a chance that a hacker could gain control of their account, no? In the case of gaining control of an admin's account, they could do whatever they want: ban people or delete the entire forum. So, stop showing me my session ID. Surely, you can pass it from one page to another without having to actually show it in the address bar. |
|
Nathyn
Joined: 25 Sep 2005
Posts: 7341
Location: The Great Satan
|
| Posted: Mon Sep 18, 2006 4:58 am Post subject: |
|
|
David wrote: You should be the only one seeing those and only when they happen.
I know that, but someone could still copy and paste the session ID into a post on the forum by accident. I've done it before, actually, but quickly edited it out. |
|
