<html>
<body>
At 12:26 PM 10/11/2013 -0700, Galen Charlton wrote:<br>
<blockquote type=cite class=cite cite>On Thu, Oct 10, 2013 at 3:17 AM,
Marcel de Rooy
<<a href="mailto:M.de.Rooy@rijksmuseum.nl">M.de.Rooy@rijksmuseum.nl</a>>
wrote:<br>
<dl>
<dd>I have been looking for these patches on Bugzilla, but I cannot find
them. </blockquote>
</dl>[snip]<br>
<blockquote type=cite class=cite cite>
<dl>
<dd>The patches lack a bug number because of a chicken-and-egg problem,
as the bug couldn't be posted before the patches and the release
announcement were.<br>
<dd>These patches have a nasty side-effect. If you use an older Koha
version and also current master on the same system for testing, the old
Koha version will stumble over this (shared) cookie:</blockquote>
</dl>[snip]<br>
<blockquote type=cite class=cite cite>An alternative configuration which
may better suit your needs is to use name-based virtual hosts rather than
port-based ones, which will perforce ensure that the two versions don't
share cookies.</blockquote>[snip]<br>
<blockquote type=cite class=cite cite>Considering that the security
release was made at the end of July, was targeted at supported *and*
unsupported versions, and was heavily publicized, there is already a fair
amount of negative data </blockquote><br>
"Name based" v. "port based", "Nasty side
effects" and "negative data" raise flags with me. I've
just looked up bug 10657 which either blind-sides me with science or
baffles me with bull. "Storable" and references to
"<pre>checked for JSON-correctness and is ignored" are
meaningless without context.
</pre>If there really is a security aspect would someone please explain
it?<br><br>
OFF-LIST if need be.<br><br>
Many thanks - Paul</body>
</html>