Description: ------------ While on the PEAR site, I noticed that, without ever logging in myself, I was randomly logged in as someone else. It should be noted that other log in/out bugs occur when users are logged in. I was not logged in and I have never had a user account at the site. Here's an email I sent to the gentleman whose identity I briefly took over: Hello, Kevin. On 11 Dec 2005 03:39:32 -0000, kevin cook <kevin@cookfamily.tv> wrote: >> [This message has been brought to you via pear.php.net.] >> >> While browsing the PEAR site, I noticed that it said that I was logged >> in as Anatoly Techtonik. >> >> >> >> How can this be? >> Frankly speaking, I do not know, because I do not have access to PEAR website sources or to pear.php.net server. But I've seen Pierre reported troubles with pearweb database and mentioned some cache troubles recently, so it can be that id's in database messed up or session cookies gone bad. The reasons for this mess can vary. It may be security breach with XML-RPC in the past, bug in PEAR DB package, some experimental code in pearweb or server misconfiguration (cvs.php.net moved to a new server this morning). >> >> >> Is this a bug in the site? >> Definitely. If you decide to report it you may attach this message. In addition from my side - when I am on the main/documentation/news or other static page I'm not logged in, but when I follow "login" page pearweb tells me I'm already logged in. And I'm always logged in on dynamic pages such as bugreporting or pepr proposal/package edition pages. >> >> >> Thought you should know. >> Thank you. -- --t.