Aloha,
I have an issue whereby users logging onto our SquirrelMail setup can view some of the contents of the last logged on user's email folders. I inherited the systems involved recently and, prior to this issue, had not yet touched the configuration of any of the components of the system other than to add user accounts. This is a major cause for concern and I'd like to have fixed it yestrerday. Any clues? Details follow:
Issue:
Client began reporting an issue whereby users of the same machine can logon to Squirrel Mail and gain access to the previous squirrelmail users email folders and email.
The issue is consistently repeatable.
Systems involved:
1) XServe www server and squirrel mail:
PowerPC G4, dual 1.33GHZ processors
1Gb RAM
OSX 10.4.11 Server
Apache: 1.3.41 openssl 0.9.7 DAV/1.0.3 mod_ssl/2.8.31
Squirrelmail: 1.4.15
Updated 2008-9-14 from 1.4.10a
PHP version 4.4.8
2) Mahi mail server:
2 x 2.66 GHz Dual core Intel Zeon
2GB RAM
OS X 10.4.11 (not a server version)
EIMS 3.3.7 - the mail server
Symptoms:
1) On a workstation, login as first user, I've tried with these three browsers that have been updated: Safari, Firefox or IE.
2) Logout
3) Login as second user:
a. Inbox displays subject lines of previous users Inbox.
i. Clicking on an email results in: Error: The server could not find the message you requested. Most probably your message list was out of date and the message has been moved away or deleted (perhaps by another program accessing the same mailbox). Click here to return to INBOX.
ii. Clicking on the left-panel Inbox folder refreshes to correct users inbox.
b. Previous users folders show
i. If I click on one of the other users folders (except Deleted Messages and Sent messages and Trash) I receive:
ERROR: Could not complete request.
Query: SELECT "Community contacts"
Reason Given: [TRYCREATE] mailbox does not exist
ii. After I click Check Mail top, left, I can still see the subject lines in the Deleted and Sent messages folders but clicking on them takes me to an email in the current users folders.
c. Navigate to the Deleted Messages folder and you can read the previous users messages.
d. Navigate to the Sent Messages folder and you can see the subject line of the previous users box but when you click on one it takes you to an email in your own box.
e. If you logout and back in the behavior persists but with varying degrees of access. System folders are not always accessible, sometimes the subject of the previous users email show but clicking takes you to a message in the rightful users system folder.
4) Logon as third user and you can see the first users Inbox listing
What I know:
1) Issue survives a workstation reboot.
2) Does it survive an Apache restart? WWW Server restart? EIMS server restart?
a. Logged out of wbow.
b. Restarted EIMS server
c. Log in as sbow
i. This behavior survives an EIMS restart
d. Restart httpd process on Xserve
i. The client exhibits the same behavior.
e. Restarted the www server&client exhibits same behavior.
3) Logged in with FQDN, same issue.
4) After logging into a separate user account on OD, SM still shows previous users folders.
Tried:
1) Changed php.ini magic_quotes_gpc from On to Off (per Squirrelmail recommendation.
2) Updated Squirrel Mail
I'd be very grateful for some assistance on this. I've used Squirrel Mail in the past and never had issues. Setup was straightforward and all and I never had problems so I haven't learned much about it (until recently!)
Thank you,
Wayne Bow
Start Free Trial
