PDA

View Full Version : omg I'm ceddybear?


Fiel
2010-05-17, 07:00 PM
There was a brief downtime earlier where users might have seen themselves logged in as another member of the forum. I will be very upfront in saying that no accounts were compromised as a result of what happened. This was a caching issue. Allow me to explain:

I was creating a server cache for static content (jpg, png, css, js filetypes). Unfortunately, I attached the server cache to dynamic content (php pages) and not the static content. As a result, the server cached entire php pages from other users. Then when someone else requested a webpage using the same php script, the server cache spit out the cached file it already had. For a simplified version, look at the following:

Ceddybear - "Refreshes main forum page"
Server - Generates the requested webpage
Server - Stores the content of Ceddybear's requested forum page in memory
Server - Sends Ceddybear his correctly rendered page
RickDal - "Refreshes main forum page"
Server - Checks cache for an already generated forum page
Server - Sees that the forum page with Ceddybear's name is already generated
Server - Sends RickDal the webpage that was sent to CeddyBear
Hilarity ensues


I have since fixed this bug so that the static content is cached and not the dynamic content. So, the forums should be loading quite a bit faster now. Mea Culpa on the bug!

-- Fiel
Rob
2010-05-17, 07:03 PM
http://i39.tinypic.com/207kbxc.png


yeaaaaaaaaaaah
Hazzy
2010-05-17, 07:05 PM
I didn't notice anything about this.... weird.
Sounds like a really easy-to-do April Fools prank.
Fiel
2010-05-17, 07:06 PM
I didn't notice anything about this.... weird.
Sounds like a really easy-to-do April Fools prank.

Very bad april fools prank.

If I hadn't noticed this very bad bug, people could have gone into their private message inbox, clicked on a private message, and see other people's private messages instead of the one they wanted to see. Definitely not a good thing. I had to nip this in the butt fast.
Rob
2010-05-17, 07:07 PM
Actually no. I tried getting into MasPan's inbox but it prompted to mine instead.
Hazzy
2010-05-17, 07:11 PM
Actually no. I tried getting into MasPan's inbox but it prompted to mine instead.

Maybe you were the first person to try and read PMs during this bug?

Fiel, you could add an exception to sensitive pages like that.
Rob
2010-05-17, 07:12 PM
Maybe you were the first person to try and read PMs during this bug?

I know right.
Fiel
2010-05-17, 07:14 PM
Fiel, you could add an exception to sensitive pages like that.

In a sense, all pages are sensitive. Users might click to go to a page and see the super-secret-no-it-doesn't-exist-mod-forum. That would be bad news. All we ever do in there is hold secret meetings, talk about our hatred of users, and high-five each other at every infraction point.
Rob
2010-05-17, 07:15 PM
In a sense, all pages are sensitive. Users might click to go to a page and see the super-secret-no-it-doesn't-exist-mod-forum. That would be bad news. All we ever do in there is hold secret meetings, talk about our hatred of users, and high-five each other at every infraction point.

Why didn't I think about this!
Eos
2010-05-17, 07:51 PM
In a sense, all pages are sensitive. Users might click to go to a page and see the super-secret-no-it-doesn't-exist-mod-forum. That would be bad news. All we ever do in there is hold secret meetings, talk about our hatred of users, and high-five each other at every infraction point.

You left out the celebratory fruit punch.
Cyadd
2010-05-17, 08:12 PM
I had to nip this in the butt fast.

Lol.
Sarah
2010-05-17, 08:18 PM
Lol.


Doesn't sound very sanitary, does it?

Couldn't stop laughing when I read that.

Nip in the butt (http://www.phrases.org.uk/meanings/256600.html)
Swerve
2010-05-17, 09:25 PM
In a sense, all pages are sensitive. Users might click to go to a page and see the super-secret-no-it-doesn't-exist-mod-forum. That would be bad news. All we ever do in there is hold secret meetings, talk about our hatred of users, and high-five each other at every infraction point.

You know that this is exactly what ----------'s administration board looks like. Except they use pictures from the movie Gladiator to decide "Yay" or "Nay" on certain users.

Ahaha. Point taken and name omitted. But they had a problem awhile back where their administration boards were open to user view and everyone got a glimpse at it within a forty-five minute time slot.
Rick
2010-05-17, 09:31 PM
You left out the celebratory fruit punch.

We decided to drop that after Ray's little incident, remember?

Also, for a few seconds, I was Piggy 2.0
Eos
2010-05-17, 09:47 PM
We decided to drop that after Ray's little incident, remember?


I always forget Ray is why we can't have nice things. :f4:
Sn1perJohnE
2010-05-18, 12:06 AM
This even funnier, because i started thinking Ceddy was someones alt last night in the irc. Lawls all around!
★★★★★
2010-05-18, 01:35 AM
Unfortunatly, i was not online for this...

Darn!
Link
2010-05-18, 02:52 AM
Unfortunatly, i was not online for this...

Darn!

Me either. D: Oh well. :f3:
TøbiasBlack
2010-05-18, 03:10 AM
Unfortunatly, i was not online for this...

Darn!

i was and i still missed it.
Kalovale
2010-05-18, 03:21 AM
Most win thread of the month, and it was made in Site Announcement.
ImagineAll
2010-05-18, 10:37 PM
Most win thread of the month, and it was made in Site Announcement.Pretty much what I was thinking, lol.
Infection
2010-05-18, 10:51 PM
Woooow. LOL.
Stereo
2010-05-18, 11:00 PM
Very bad april fools prank.

If I hadn't noticed this very bad bug, people could have gone into their private message inbox, clicked on a private message, and see other people's private messages instead of the one they wanted to see. Definitely not a good thing. I had to nip this in the butt fast.

As long as it was caching the entire request (http://www.southperry.net/showthread.php?t=27244&page=1, not http://www.southperry.net/showthread.php) I don't think that would happen.

Then again, there are better ways of pranking the homepage to show the wrong username than an aggressive cache.



Like replacing the colour tags for usernames with someone's name and then an invisible span that held their actual name.
Fiel
2010-05-19, 11:33 AM
As long as it was caching the entire request (http://www.southperry.net/showthread.php?t=27244&page=1, not http://www.southperry.net/showthread.php) I don't think that would happen..

The regex command I'm using on the URL is this:

^((?!\.php).)*$

Anything that is not covered by that command --> send to backend apache server.

I'm using nginx as a reverse proxy for static content.