PunBB Forums — Possible race condition in check_cookie()

Re: Possible race condition in check_cookie()

null@example.com (Rickard) — Wed, 22 Mar 2006 17:45:06 +0000

Ulph wrote:

OK, thanks.
Why hasn't a fix been included in the current punbb?
If the transactions don't prevent this sort of race condition I can see where other problems easily could emerge, although not as often.

Because it's very rare. It will be dealt with in the next release.

Re: Possible race condition in check_cookie()

null@example.com (Miles) — Tue, 21 Mar 2006 22:58:53 +0000

What about a UNIQUE constraint on the online table on (user_id, ident)?

Re: Possible race condition in check_cookie()

null@example.com (Smartys) — Wed, 08 Mar 2006 11:42:57 +0000

Transactions aren't used by PunBB (at least in MySQL, I can see working transaction functions in the dblayer class for pgsql but I don't know that they're used), the reason being that only MyISAM tables don't support row locking

Re: Possible race condition in check_cookie()

null@example.com (Ulph) — Wed, 08 Mar 2006 11:33:36 +0000

OK, thanks.

Why hasn't a fix been included in the current punbb?

If the transactions don't prevent this sort of race condition I can see where other problems easily could emerge, although not as often.

Re: Possible race condition in check_cookie()

null@example.com (CodeXP) — Tue, 07 Mar 2006 21:23:05 +0000

See this topic: http://punbb.org/forums/viewtopic.php?id=8436

Possible race condition in check_cookie()

null@example.com (Ulph) — Tue, 07 Mar 2006 19:37:11 +0000

I have noticed that some users can get logged in twice. This causes messages from that particular user to be displayed twice.

I think the problem may be that you we do a query to get online status, check the online status and then update the database. This would cause a race condition if it isn't done atomically. Hm.. is this the case or would the begin/commit enclosing prevent that?

I am using postgresql and latest punbb.

EDIT: Hm.. after some more checking it seems like the transactions really should prevent race conditions, but I can't see how a users could get inserted twice into the online table otherwise..