| Weekly edition | Kernel | Security | Distributions | Search |
| Archives | Calendar | Subscribe | Write for LWN | LWN.net FAQ |
Wordpress Cookie Authentication Vulnerability
Wordpress Cookie Authentication Vulnerability
Posted Nov 19, 2007 21:29 UTC (Mon) by jwb (subscriber, #15467)Parent article: Wordpress Cookie Authentication Vulnerability
Oh boy! As a system administrator there's nothing I like better than yet another mediocre PHP hack with its own half-baked authentication and authorization system. I have a version of wordpress kicking around here somewhere but a few months back I ripped out the auth/authz code and made it respect the authenticated user coming from Apache, which is IMHO the only sane way to do things.
(Log in to post comments)
Wordpress Cookie Authentication Vulnerability
Posted Nov 19, 2007 23:03 UTC (Mon) by tobor (guest, #36736) [Link]
Don't blame the language for this worse-than-failure design decision.
Wordpress Cookie Authentication Vulnerability
Posted Nov 21, 2007 21:21 UTC (Wed) by judas_iscariote (subscriber, #47386) [Link]
not only the authentication system design is horrible...wordpress is a great example of a cool blog user interface but an horrible, messy, insecure code.
Apache security
Posted Nov 20, 2007 3:08 UTC (Tue) by ccyoung (subscriber, #16340) [Link]
if you do not trust app security, then apache security is a savior. nonetheless apache security is not cheap, requiring extra transmission bytes, extra processing, and (frequently many) extra db reads per page access.