Crucial Security Bug? User switch and edit ?

OMG, I have a really strange bug in my J!1.5 CB1.8 project. Never seen this before:

I am logged in with USER1 ...
goto another Profile of USER2 ...
I see my login module with avatar on the left side.

If I just RELOAD the page...
I do switch to the viewed USER2. The login avatar changes to USER2. And now I AM USER2.
I can edit HIS Profile now!?!?

This happens on any viewed userprofile. Any clue?!?

pepperstreet wrote: OMG, I have a really strange bug in my J!1.5 CB1.8 project. Never seen this before:

I am logged in with USER1 ...
goto another Profile of USER2 ...
I see my login module with avatar on the left side.

If I just RELOAD the page...
I do switch to the viewed USER2. The login avatar changes to USER2. And now I AM USER2.
I can edit HIS Profile now!?!?

This happens on any viewed userprofile. Any clue?!?

I cannot replicate this on my J15 test site - something else is happening on your environment - guessing not CB related.


If you can replicate on a clean install I will take another look (guessing you cannot).

First time I hear such issue..
Just tested on my site and I don't have such a "bug".. and it's definitely not a CB bug... this seems like a "unsuccessful" joomla/cb code customization that you did..

Sounds like a caching issue. Disable all caching and purge existing caching to see if it resolves.

krileon wrote: Sounds like a caching issue. Disable all caching and purge existing caching to see if it resolves.

Tried that. No difference.

To answer the previous thoughts and comments:
I have no modified CB or any fancy stuff on this installation. I started from a CB1.2.3 and updated over the last weeks to CB1.8. Additionally I installed all incubator stuff, but most things are not activated or even configured. Currently the profile displays standard stuff like two tabs with personal info; Guestbook, Forum tab. Forum was updated to Kunena 1.7.x
Tried the AjaxCore field feature on the two personal info tabs. Was working fine. Also tried it "disabled".


I have an older copy with CB1.2.3 of the same site, there was no such error.

The big question is? Is it a messed-up Joomla login/session/token thingy issue?!?
And even more important: How to find and surround the culprit? I dont´know where to begin...

What parts of Joomla and DB tables are involved in this login/access issue? Can I replace or clean-up something WITHOUT re-builduing the whole site?

Any help is much appreciated.

It's possible you've done something to cause user rows to no longer be in sync. For example you have id 42 in _users and you have user_id 42 in _comprofiler, but for the _comprofiler row you have 48. No idea what to tell you as have never had this happen. Best approach is to pretty much disable everything 1 by 1 to see if it resolves.