Security upgrades, bugs fixed

Summary:

authenticating system upgrade

page 1 of 212next »

Security upgrades, bugs fixed

Gabrys 18 Aug 2008 13:04

Dear Wikidottians,

today we've upgraded the authenticating system on Wikidot. This enhances the security level and fixes some bugs that appeared when using Internet Explorer (and Safari) and wikis on custom domains (i.e. not in the .wikidot.com domain).

We have also decided to improve the log-in system — from now on there is one single and secure login URL used for authenticating: https://www.wikidot.com/auth:login. This, together with the SSL, dramatically improves security and is especially important for people logging into domains hosted by Wikidot but from outside of the wikidot.com domain.

We hope all bugs related to Internet Explorer, cookies and custom domains are now gone. In case of any please contact our Support Team either at the dev-list, moc.todikiw|troppus#liame troppus or on the community forums.

Regards,
Your Wikidot Team

---

Piotr Gabryjeluk
visit my blog

Last edited on 18 Aug 2008 22:13 by Gabrys + Show more

Re: Security upgrades, bugs fixed

David Marseilles 18 Aug 2008 23:48

Thanks.

Re: Security upgrades, bugs fixed

Helmuti_pdorf 19 Aug 2008 07:01

I see on the rev numbers and the changelog what a hard work was done by you and the team.
Thanks for the (dramatically) changes of the last 14 days leading into usage of wdfiles.com , "auth:logiin" and the "cookies for IE".

Hope we have a little time of silence now to relax! :)

There are so much new features…I want to use on a more intensive way the "internal" html usage with the "code" tag..

Thanks again!

---

Service is my success. My webtips:www.blender.org (Open source), Wikidot-Handbook.

Sie können fragen und mitwirken in der deutschsprachigen » User-Gemeinschaft für WikidotNutzer oder
im deutschen » Wikidot Handbuch ?

Last edited on 19 Aug 2008 07:51 by Helmuti_pdorf + Show more

Re: Security upgrades, bugs fixed

Jonathon Brown 20 Aug 2008 04:25

I manage a private wiki for a university course. On the evening of 8/18, the "login" popup from the landing page for non-members (join page) stopped working. Additionally, many of my students try visit the site and are asked to login. Due to the popup issue, they then try to login via the login link at the top of the page, only to find out that the system shows them as already shown as logged in. Logging out and logging back in did not work until the "remember me" and "bind my session" options were deselected.

Questions:
1. How do I make the join page work correctly? Do I have to edit the links for the page such that they point to the address above? Is the pop-up interface for logging in now disabled and gone forever?
2. Why are people who the system recognizes as logged in unable to access both a site where they are members and their "my account" pages without taking the steps listed above?

I've had to change this private site to public until I can address these issues. Any help is greatly appreciated.

Thank you,
Jonathon Brown
Lecturer, RMIT International University Vietnam
http://riuv-im.wikidot.com

Re: Security upgrades, bugs fixed

Gabrys 20 Aug 2008 09:28

Jonathon Brown,

issues with remember me and bind my session can happen if your users use some kind of proxy and then we can't do anything with it. Some ISPs do proxies, that users don't know about. Despite of this fact we NEED to know what browsers your users use, maybe we'll manage to reproduce the situation.

The login box showing on wiki sites is gone. Now logging in is only possible with the secure (https) page listed in the news (https://www.wikidot.com/auth:login).

EDIT: I've sent you a private message with some questions, we'll try to identify and fix the problem.

---

Piotr Gabryjeluk
visit my blog

Last edited on 20 Aug 2008 10:01 by Gabrys + Show more

Re: Security upgrades, bugs fixed

Gabrys 21 Aug 2008 18:36

We've fixed even those issues with proxies, that Jonathon described. It was quite (really) tricky, but it seems to work well now :).

---

Piotr Gabryjeluk
visit my blog

Re: Security upgrades, bugs fixed

Magnes 22 Aug 2008 18:21

"Can't proceed, you should accept cookies for this domain. Then you can go back to http://magazyn.wieza.org/" - I get something like that when I try to open my wikidot page (magazyn.wieza.org). It's not clear what should I do… Is this a bug or sth? The same on nieboracy.wieza.org…
But my other wikidot page with the same domain (gobas.wieza.org) works fine.
PS. I'm using Firefox 3.0 on Ubuntu. I can open those pages when I'm not logged in. But as soon as I log in - the message apears…

---

My free music on Jamendo, soundtracks-like, my photography blog
Only in Polish: http://wieza.org (RPG, fantastyka)

Last edited on 22 Aug 2008 18:27 by Magnes + Show more

Re: Security upgrades, bugs fixed

michal frackowiak 23 Aug 2008 07:27

This is very strange. Please try one more thing: remove all WIKIDOT_SESSION_ID cookies from the wieza.org domain and your subdomains. Are you using any cookie-related firefox extensions? Are you using some router/firewall that filters cookies?

We can easily access your wikis, either logged-in or not, Firefox or any other browser, with proxies between and without.

If your problem persists, we will deal with it on Monday.

---

Michał Frąckowiak @ Wikidot Inc.
Visit my blog at michalf.me

Re: Security upgrades, bugs fixed

Magnes 23 Aug 2008 10:58

Deleting WIKIDOT_SESSION_ID cookies helped. Thank you.

---

My free music on Jamendo, soundtracks-like, my photography blog
Only in Polish: http://wieza.org (RPG, fantastyka)

Re: Security upgrades, bugs fixed

Whane The Whip 23 Aug 2008 22:23

Here's to hoping that this will lead to a message handler that will let users return to the site after use. Until then there really is no way for a large community to form onsite or within a domain. This is mainly because with a large community there will be a need for inter-community communication too.

---

Atheism Blog

Last edited on 23 Aug 2008 22:25 by Whane The Whip + Show more

page 1 of 212next »