Bug 46282 - Clicking ?stage=Stage link sets cookie that renders site unusable
Summary: Clicking ?stage=Stage link sets cookie that renders site unusable
Status: RESOLVED WORKSFORME
Alias: None
Product: LibreOffice
Classification: Unclassified
Component: WWW (show other bugs)
Version:
(earliest affected)
unspecified
Hardware: Other All
: medium normal
Assignee: Not Assigned
URL:
Whiteboard:
Keywords:
Depends on:
Blocks:
 
Reported: 2012-02-19 04:56 UTC by Emil Stenström
Modified: 2012-02-19 05:42 UTC (History)
1 user (show)

See Also:
Crash report or crash signature:


Attachments

Note You need to log in before you can comment on or make changes to this bug.
Description Emil Stenström 2012-02-19 04:56:15 UTC
How to reproduce:

1) Click this link: https://www.libreoffice.org/download35/?stage=Stage

2) Don't log in, but instead try to click in the top menu. Note that you're redirected to the same login page whatever you try to do.

3) Try accessing the site without http. Note that you are redirected to the login page. You are stuck in a loop.

I think this is a major problem, since this renders the site unusable, by just clicking a link. Anyone could send people to the link above (knowingly or not), and have people unable to use your site at all.

Workaround:
* Remove sessoin cookies for libreoffice.org, and note how things work again.
Comment 1 Christian Lohmaier 2012-02-19 05:34:29 UTC
wontfix/worksforme.

The login page reads:
#####
Log in

You must log in with your CMS password in order to view the draft or archived content. *Click here to go back to the published site.*

<input for login>
<input for password>
#####

All of "Click here to go back to the published site" is a link that will lead the user to the public pages.

Cannot help when people don't read two lines of text, no matter where you put it, people will overlook it.

Besides you should never encounter such a link outside of the project's internal mailinglists, so people usually are aware of the difference between stage &
live/public site.
Comment 2 Emil Stenström 2012-02-19 05:42:23 UTC
I respect your decision. I might be the only one stumbling over this.

A minor side-note: This is why I didn't read that text: http://www.useit.com/alertbox/9710a.html