Please do not reply directly to this email. All additional comments should be made in the comments box of this bug.
Summary: Review Request: drupal-securepages_prevent_hijack - Secure Pages add-on that prevents hijacked sessions from accessing SSL pages
https://bugzilla.redhat.com/show_bug.cgi?id=570864
Summary: Review Request: drupal-securepages_prevent_hijack - Secure Pages add-on that prevents hijacked sessions from accessing SSL pages Product: Fedora Version: rawhide Platform: All OS/Version: Linux Status: NEW Severity: medium Priority: medium Component: Package Review AssignedTo: nobody@fedoraproject.org ReportedBy: orion@cora.nwra.com QAContact: extras-qa@fedoraproject.org CC: notting@redhat.com, fedora-package-review@redhat.com Depends on: 570862 Estimated Hours: 0.0 Classification: Fedora
Spec URL: http://www.cora.nwra.com/~orion/fedora/drupal-securepages_prevent_hijack.spe... SRPM URL: http://www.cora.nwra.com/~orion/fedora/drupal-securepages_prevent_hijack-6.x...
Description: This is an add-on to the Secure Pages module that will prevent hijacked sessions from accessing SSL pages, yet still allow users to stay logged in when browsing non-SSL pages.
The login form is also secured, both on the user page and the login block.
This module is recommended for most securepages users. (One possible exception is if you have set session.cookie_secure, and you have "Switch back to http" disabled in the securepages settings.)
Please do consider carefully the inherent limitations of mixed HTTP / HTTPS sessions. For an analysis of various approaches to using SSL, see this[1] article on crackingdrupal.com.
[1] - http://crackingdrupal.com/blog/greggles/drupal-and-ssl-multiple-recipes-poss...
Please do not reply directly to this email. All additional comments should be made in the comments box of this bug.
https://bugzilla.redhat.com/show_bug.cgi?id=570864
Sven Lankes sven@lank.es changed:
What |Removed |Added ---------------------------------------------------------------------------- CC| |sven@lank.es AssignedTo|nobody@fedoraproject.org |sven@lank.es
--- Comment #1 from Sven Lankes sven@lank.es 2010-11-19 10:04:12 EST --- After some discussion on the fedora-logistics list, we've come to the conclusion that having the possibility to install multiple concurrent versions of drupal is desirable.
The drupal-package is going to be renamed to drupal6 (rename review is pending).
Additionally, the guidelines don't allow letters in the version (so no 6.x) - so please rename the package to drupal6-securepages_prevent_hijack-1.5.
Once that is done, I'll do the review.
Please do not reply directly to this email. All additional comments should be made in the comments box of this bug.
https://bugzilla.redhat.com/show_bug.cgi?id=570864
--- Comment #2 from Orion Poplawski orion@cora.nwra.com 2010-11-23 11:43:55 EST --- http://www.cora.nwra.com/~orion/fedora/drupal6-securepages_prevent_hijack.sp... http://www.cora.nwra.com/~orion/fedora/drupal6-securepages_prevent_hijack-1....
Please do not reply directly to this email. All additional comments should be made in the comments box of this bug.
https://bugzilla.redhat.com/show_bug.cgi?id=570864
Volker Fröhlich volker27@gmx.at changed:
What |Removed |Added ---------------------------------------------------------------------------- CC| |volker27@gmx.at
--- Comment #3 from Volker Fröhlich volker27@gmx.at 2011-01-18 08:57:37 EST --- Please correct the license to GPLv2+, as all modules hosted in Drupal's CVS must be.
package-review@lists.fedoraproject.org