CS 2007.1 bug in cookie authorization

Reply

dshilov Posted: Thu, Mar 27 2008 9:46 AM

rated by 0 users

Looks like there is a bug in authorization based on cookie. It can be reproduced with following steps:

1. Create some user. Login to CS site

2. Delete user

3. Try to open CS site again

I think this happens due to the fact that CS code do not deal with situations when we have some out-dated or rogue cookies. It makes sense to handle such situations and if cookie is not OK, then redirect to login page or something.

Here is an exception report

  UnknownError   10.245.181.16   03-27-2008, 03:28 PM  

Path: /default.aspx as HTTP GET

Referrer:

Message: Object reference not set to an instance of an object.

System.NullReferenceException: Object reference not set to an instance of an object.

at CommunityServer.Components.CSLocation.ThemePage(ReWrittenUrl url) in C:\Program Files\Telligent\SDK\CS2007.1\source\Components\Components\CSLocation.cs:line 18

at CommunityServer.Urls.Location.GetReWrittenUrl(ReWrittenUrl url, String path, String queryString) in C:\Program Files\Telligent\SDK\CS2007.1\source\CommunityServer.Urls\Location.cs:line 155

at CommunityServer.Urls.Location.GetReWrittenUrl(HttpContext context, String path, String queryString) in C:\Program Files\Telligent\SDK\CS2007.1\source\CommunityServer.Urls\Location.cs:line 196

at CommunityServer.Urls.UrlReWriteProvider.GetRewrittenUrl(HttpContext context) in C:\Program Files\Telligent\SDK\CS2007.1\source\CommunityServer.Urls\UrlReWriteProvider.cs:line 44

at CommunityServer.CSHttpModule.ReWriteUrl(HttpContext context) in C:\Program Files\Telligent\SDK\CS2007.1\source\Components\HttpModule\CSHttpModule.cs:line 350

at CommunityServer.Components.CSContext.ExecuteUrlReWrite() in C:\Program Files\Telligent\SDK\CS2007.1\source\Components\Components\CSContext.cs:line 167

at CommunityServer.CSHttpModule.Application_AuthorizeRequest(Object source, EventArgs e) in C:\Program Files\Telligent\SDK\CS2007.1\source\Components\HttpModule\CSHttpModule.cs:line 264

at System.Web.HttpApplication.SyncEventExecutionStep.System.Web.HttpApplication.IExecutionStep.Execute()

at System.Web.HttpApplication.ExecuteStep(IExecutionStep step, Boolean& completedSynchronously)

Reply

rhoward replied on Thu, Mar 27 2008 10:31 AM

rated by 0 users

We'll file this as a bug to investigate.

Reply

Alex Crome replied on Thu, Mar 27 2008 10:32 AM

rated by 0 users

That's a known bug and has apparantly will be fixed for CS2007.1 SP1 and in CS2008.  (expect CS2007.1 to be released around the same time as CS2008)

Reply

dshilov replied on Thu, Mar 27 2008 10:42 AM

rated by 0 users

Thanks guys, it's good you already know about this bug.

Reply

Ken Robertson replied on Thu, Mar 27 2008 11:34 AM

rated by 0 users

This has already been addressed and is in CS 2008 Beta2 and will be in the CS 2007.1 SP1 which will be released once CS 2008 is finished.  It will now just log the use out if the user isn't found.