- Oct 27, 2005
- 84,846
- 22,522
Nope it's not ok, we're working with our upstream CDN to fix the situation at the moment.
-
Please take a moment to look over the Suggestions & Feedback rules before making a post: READ RULES HERE
Welcome , different profile name = caching issue
- Thread starter Diamond Damien
- Start date
- Status
D
Deleted member 720373
Guest
Message sent along with source code, screenshot and full downloaded html page.
Hope that will help, if you need anything further I still have the page open in my browser as I stated in the email.
The Doctor
Senior Member
- Dec 18, 2010
- 1,110
- 474
Confirmed that I was also able to get someone's full notepad information which included JV info and some other personal data involving bitcoin (Not that I care about it and you'll see it in the source) as well their list of subscription folders. Makes me wonder what else could be delivered from the cache such as if the person has remember me set and it serves me up their cookie...
I blanked out their data except to show the term JV at the top. Wow I spent almost 2 hours expanding DOM elements before giving up (too many) before finally viewing source in FF which worked just fine. Emailing source now. Never checked cookies.
I blanked out their data except to show the term JV at the top. Wow I spent almost 2 hours expanding DOM elements before giving up (too many) before finally viewing source in FF which worked just fine. Emailing source now. Never checked cookies.
Last edited:
The Doctor
Senior Member
- Dec 18, 2010
- 1,110
- 474
Email has been sent with pic and usercp.html file.
The Doctor
Senior Member
- Dec 18, 2010
- 1,110
- 474
If you temporarily change your DNS to not use the CDN is the server going to lock?
The Doctor
Senior Member
- Dec 18, 2010
- 1,110
- 474
Everyone: If you have any information in your BHW notepad you don't want anyone to see you should remove it immediately. Might want a temporary forum notice on this.
The Doctor
Senior Member
- Dec 18, 2010
- 1,110
- 474
Sorry for all the bumping. You're no doubt busy. I made this thread to warn people of what other users can currently see of theirs and to remove it if they don't want it viewed: http://www.blackhatworld.com/blackh...r-can-access-your-bhw-settings-page-info.html
The Doctor
Senior Member
- Dec 18, 2010
- 1,110
- 474
Apricot, the point of that was to keep something bumped where everyone is at least aware but with a forum this size that's hardly enough. It's your forum but if it were me, I would have immediately had someone activate the forum notice and blast an email to everyone telling them what information of theirs other people have access to in case they might have reason to remove it. I might have even taken the forum down until it was resolved or simply added die("We're currently fixing an error on this page"); to the top of usercp.php. It's basic responsible disclosure of a security breach (Which this is, even though a CDN caching issue caused it). I know how pissed off a web site owner gets when something like this happens. I also know how outsiders judge your response to it. Just trying to help. Hope you can get it worked out soon.
Last edited:
The Doctor
Senior Member
- Dec 18, 2010
- 1,110
- 474
If you guys do that, simply add (since I'm guessing you still need to be able to visit that page)
PHP:
if(!isset($_GET['somerandomstring'])){ die("We're currently performing maintenance on this page. Please check back soon."); }to the top of usercp.php after the <? line then to run tests on the page access it by: http://www.blackhatworld.com/blackhat-seo/usercp.php?somerandomstring=1
(Where only you know the random string).
- Mar 26, 2013
- 14,954
- 11,759
One thread, one source of information - if you want to bump, keep it here. Starting multiple threads with speculation on the problems, or your opinion on how it needs to be dealt with, helps no-one. If you think you have information to offer, use one of the contact channels, don't blast it out across the lounge. Dealing with misinformation and opinion threads takes up valuable time & slows everything down.
Last edited:
The Doctor
Senior Member
- Dec 18, 2010
- 1,110
- 474
I don't care about the other thread but it wasn't misinformation or opinion. This thread has nothing to do with informing the mass of people on the forum which represents the scope of this problem. Anyway, I just traversed a DOM for two hours and now wrote a line of code for you in the post above. Sorry.
- Oct 27, 2005
- 84,846
- 22,522
Thank you for all your comments BHW - we have a solution that we're currently implementing. Should be cleared soon. Keeping all comments on one thread helps us manage any changes in the situation and gives people one source for information.
As this is only happening to a select number of people isolating the source took longer than expected. We have a fix for right now and setting up the one for longer term so this doesn't happen again.
To reiterate earlier points this is only a caching issue and no one has access to the pm's (they are not cached) earlier reports of pm access have all ended up being the panel not the actual pm. Full logging is now enabled allowing us to pick up any issues. This will be disabled as soon as we're clean and clear.
Thanks for your continued support.
As this is only happening to a select number of people isolating the source took longer than expected. We have a fix for right now and setting up the one for longer term so this doesn't happen again.
To reiterate earlier points this is only a caching issue and no one has access to the pm's (they are not cached) earlier reports of pm access have all ended up being the panel not the actual pm. Full logging is now enabled allowing us to pick up any issues. This will be disabled as soon as we're clean and clear.
Thanks for your continued support.
The Doctor
Senior Member
- Dec 18, 2010
- 1,110
- 474
How did Akamai wind up serving up cached versions of usercp.php to the wrong sessions? It could be useful for me to know since I use CDNs all the time.
Last edited:
- Oct 27, 2005
- 84,846
- 22,522
Ran tests direct into the server bypassing the CND's no issue - remove the bypass issue comes back.
- Oct 27, 2005
- 84,846
- 22,522
We're working on a fix right now.
If this happens to you please send me a screen shot AND the page source code
Thanks
DD
If this happens to you please send me a screen shot AND the page source code
Thanks
DD
The Doctor
Senior Member
- Dec 18, 2010
- 1,110
- 474
WoW...
I was thinking maybe cloudflare could be a solution for now? It's usually easy to get setup there. I wish I knew more about akamai to give suggestions but I've never used them before. All pages private or otherwise are now suffering from the issue.
I was thinking maybe cloudflare could be a solution for now? It's usually easy to get setup there. I wish I knew more about akamai to give suggestions but I've never used them before. All pages private or otherwise are now suffering from the issue.
The Doctor
Senior Member
- Dec 18, 2010
- 1,110
- 474
I have three new sshots and sources if you still need them. Sending PMs is nearly impossible.
Last edited:
- Status