OT: reply [LWN.net]

OT: reply

Posted Feb 14, 2008 11:51 UTC (Thu) by intgr (subscriber, #39733)
In reply to: OT: reply by rfunk
Parent article: vmsplice(): the making of a local root exploit

I've seen this repeatedly with Firefox, probably because I always throw out all browser
cookies on exit; the refresh trick always fixes it.

This is how the problem occurs for me:

1. I'm not logged in and click on an article that requires subscription; LWN informs me that I
can't see this article.
2. I click on "log in to read this article"; https://lwn.net/login?target=/Articles/268783/
3. After filling in username and password, I'm redirected to the
http://lwn.net/Articles/268783/ page without the "reply to this comment" buttons -- as if LWN
thought I wasn't logged in.
4. Reloading the page makes the buttons appear.

To reproduce the bug again, I have to clear my cache (!) after logging out. This would suggest
that it depends on some external dependency (like CSS or JavaScript) that varies depending on
login, but gets cached pre-login by the browser. However I couldn't find such dependencies on
the LWN site.

(Log in to post comments)

OT: reply: FireFox versus CSS

Posted Feb 14, 2008 14:42 UTC (Thu) by hummassa (subscriber, #307) [Link]

I think it is a CSS problem. As I use non-standard colors, when I do the same operation ("log
in to read this article"), it comes back with the default colors instead of my colors. At this
point, I refresh the page... hence I don't encounter the "no buttons" problem.

OT: reply

Posted Feb 19, 2008 8:09 UTC (Tue) by intgr (subscriber, #39733) [Link]

So it turns out that this indeed is the problem; the stylesheet file sizes only differ in one byte so I didn't catch the difference the first time (I thought they were equal).

--- lwn_logged_out.css  2008-02-19 09:58:38.000000000 +0200
+++ lwn_logged_in.css   2008-02-19 09:57:04.000000000 +0200
@@ -135,7 +135,7 @@
 DIV.CommentBody { padding: 0px 4px 0px 4px; }
 P.CommentPoster { margin-top: 0px; }

-div.CommentReplyButton { display: none;
+div.CommentReplyButton { display: block;
                         text-align: right;
                         padding: 4px; }

The problem here is browser cache. When the user first visits LWN.net, not having logged in yet, the browser downloads /CSS/lwn which specifies that div.CommentReplyButton should be hidden.

Later when the user does log in, the browser doesn't bother re-fetching the stylesheet because it already has this URL cached. The Right Way to fix this is to have different stylesheet URLs depending on whether the user is logged in -- rather than using magic stylesheets.