Your message dated Thu, 10 Nov 2005 16:32:07 -0800 with message-id <E1EaMpr-0006fy-Uz@spohr.debian.org> and subject line Bug#336719: fixed in drupal 4.5.5-3 has caused the attached Bug report to be marked as done. This means that you claim that the problem has been dealt with. If this is not the case it is now your responsibility to reopen the Bug report if necessary, and/or fix the problem forthwith. (NB: If you are a system administrator and have no idea what I am talking about this indicates a serious mail system misconfiguration somewhere. Please contact me immediately.) Debian bug tracking system administrator (administrator, Debian Bugs database) -------------------------------------- Received: (at submit) by bugs.debian.org; 1 Nov 2005 04:09:02 +0000

From ben@whenitsdone.com Mon Oct 31 20:09:02 2005 Return-path: <ben@whenitsdone.com> Received: from vscan02.westnet.com.au [203.10.1.132] by spohr.debian.org with esmtp (Exim 3.36 1 (Debian)) id 1EWnSH-00072E-00; Mon, 31 Oct 2005 20:09:01 -0800 Received: from localhost (localhost.localdomain [127.0.0.1]) by localhost (Postfix) with ESMTP id 9F71311ABE8; Tue, 1 Nov 2005 12:08:28 +0800 (WST) Received: from vscan02.westnet.com.au ([127.0.0.1]) by localhost (vscan02.westnet.com.au [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 02394-07; Tue, 1 Nov 2005 12:08:28 +0800 (WST) Received: from duron.workgroup (dsl-202-173-188-35.qld.westnet.com.au [202.173.188.35]) (using TLSv1 with cipher AES256-SHA (256/256 bits)) (No client certificate requested) by vscan02.westnet.com.au (Postfix) with ESMTP id 3A26211A8A4; Tue, 1 Nov 2005 12:08:27 +0800 (WST) Received: from ben by duron.workgroup with local (Exim 4.54) id 1EWnRi-0005Xj-Cl; Tue, 01 Nov 2005 14:08:26 +1000 Content-Type: text/plain; charset="us-ascii" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit From: Ben Hay <ben@whenitsdone.com> To: Debian Bug Tracking System <submit@bugs.debian.org> Subject: drupal: Users unable to log out X-Mailer: reportbug 3.17 Date: Tue, 01 Nov 2005 14:08:26 +1000 X-Debbugs-Cc: Debian Security Team <team@security.debian.org> Message-Id: <E1EWnRi-0005Xj-Cl@duron.workgroup> Delivered-To: submit@bugs.debian.org X-Spam-Checker-Version: SpamAssassin 2.60-bugs.debian.org_2005_01_02 (1.212-2003-09-23-exp) on spohr.debian.org X-Spam-Level: X-Spam-Status: No, hits=-11.0 required=4.0 tests=BAYES_00,HAS_PACKAGE, X_DEBBUGS_CC autolearn=ham version=2.60-bugs.debian.org_2005_01_02

Package: drupal Version: 4.5.5-2 Severity: grave Tags: security Justification: user security hole Clicking "Log Out" appears to work, however user is still logged in. See http://drupal.org/node/29201 for discussion and solution. -- System Information: Debian Release: testing/unstable APT prefers testing APT policy: (990, 'testing') Architecture: i386 (i686) Shell: /bin/sh linked to /bin/bash Kernel: Linux 2.6.12-1-bs-k7 Locale: LANG=en_AU, LC_CTYPE=en_AU (charmap=ISO-8859-1) Versions of packages drupal depends on: ii apache2 2.0.54-5 next generation, scalable, extenda ii apache2-mpm-prefork [apache2 2.0.54-5 traditional model for Apache2 ii debconf [debconf-2.0] 1.4.58 Debian configuration management sy ii exim4 4.54-1 metapackage to ease exim MTA (v4) ii exim4-daemon-light [mail-tra 4.54-1 lightweight exim MTA (v4) daemon ii makepasswd 1.10-3 Generate and encrypt passwords ii mysql-client-4.1 [virtual-my 4.1.14-6 mysql database client binaries ii php4-cli 4:4.3.10-16 command-line interpreter for the p ii php4-mysql 4:4.3.10-16 MySQL module for php4 ii postgresql-client 7.5.11 front-end programs for PostgreSQL ii wwwconfig-common 0.0.44 Debian web auto configuration Versions of packages drupal recommends: pn apache <none> (no description available) ii libapache2-mod-php4 4:4.3.10-16 server-side, HTML-embedded scripti ii mysql-server 4.1.14-6 mysql database server (transitiona ii mysql-server-4.1 [mysql-serv 4.1.14-6 mysql database server binaries ii php4 4:4.3.10-16 server-side, HTML-embedded scripti ii postgresql 7.5.11 object-relational SQL database man -- debconf information: * drupal/remove_backups: true drupal/createuser_failed: * drupal/db_auto_update: false drupal/dropdb_failed: drupal/upgradedb_impossible: * drupal/dbgeneration: false * drupal/dbtype: MySQL * drupal/database_doremove: false drupal/createdb_failed: * drupal/dbserver: localhost * drupal/webserver: apache, apache2 drupal/upgradedb_failed: * drupal/dbname: drupal drupal/dbuser: drupal drupal/dbadmin: root drupal/initdb_failed: drupal/conffile_failed: --------------------------------------- Received: (at 336719-close) by bugs.debian.org; 11 Nov 2005 00:41:47 +0000

From katie@ftp-master.debian.org Thu Nov 10 16:41:47 2005 Return-path: <katie@ftp-master.debian.org> Received: from katie by spohr.debian.org with local (Exim 4.50) id 1EaMpr-0006fy-Uz; Thu, 10 Nov 2005 16:32:07 -0800 From: Hilko Bengen <bengen@debian.org> To: 336719-close@bugs.debian.org X-Katie: $Revision: 1.56 $ Subject: Bug#336719: fixed in drupal 4.5.5-3 Message-Id: <E1EaMpr-0006fy-Uz@spohr.debian.org> Sender: Archive Administrator <katie@ftp-master.debian.org> Date: Thu, 10 Nov 2005 16:32:07 -0800 Delivered-To: 336719-close@bugs.debian.org X-Spam-Checker-Version: SpamAssassin 2.60-bugs.debian.org_2005_01_02 (1.212-2003-09-23-exp) on spohr.debian.org X-Spam-Level: X-Spam-Status: No, hits=-6.0 required=4.0 tests=BAYES_00,HAS_BUG_NUMBER autolearn=no version=2.60-bugs.debian.org_2005_01_02

Source: drupal Source-Version: 4.5.5-3 We believe that the bug you reported is fixed in the latest version of drupal, which is due to be installed in the Debian FTP archive: drupal_4.5.5-3.diff.gz to pool/main/d/drupal/drupal_4.5.5-3.diff.gz drupal_4.5.5-3.dsc to pool/main/d/drupal/drupal_4.5.5-3.dsc drupal_4.5.5-3_all.deb to pool/main/d/drupal/drupal_4.5.5-3_all.deb A summary of the changes between this version and the previous one is attached. Thank you for reporting the bug, which will now be closed. If you have further comments please address them to 336719@bugs.debian.org, and the maintainer will reopen the bug report if appropriate. Debian distribution maintenance software pp. Hilko Bengen <bengen@debian.org> (supplier of updated drupal package) (This message was generated automatically at their request; if you believe that there is a problem with it please contact the archive administrators by mailing ftpmaster@debian.org) -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Format: 1.7 Date: Fri, 11 Nov 2005 00:13:54 +0100 Source: drupal Binary: drupal Architecture: source all Version: 4.5.5-3 Distribution: unstable Urgency: low Maintainer: Hilko Bengen <bengen@debian.org> Changed-By: Hilko Bengen <bengen@debian.org> Description: drupal - fully-featured content management/discussion engine Closes: 312202 312230 319735 336719 Changes: drupal (4.5.5-3) unstable; urgency=low . * Pulled in includes/session.inc from upstream's 4.5 branch, updated database/database.pgsql. - Fixes "Users unable to log out" issue (Closes: #336719) - Fixes "uid default missing" issue (Closes: #312230, #312202, #319735) Files: 1e67c12d6f766f9ff2d930a5b4ebf4cb 609 web extra drupal_4.5.5-3.dsc 77dade82d81243815ebe99dc7c27037c 43990 web extra drupal_4.5.5-3.diff.gz ca260e977b91ebab1983894da4964108 483486 web extra drupal_4.5.5-3_all.deb -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.2 (GNU/Linux) iD8DBQFDc9hZUCgnLz/SlGgRAkZsAKCPnUSHWcXF/lj6XwLI4bN5ol70bQCfSREH KOHYW3u/nMrMUOWjmM7NoZA= =DJMN -----END PGP SIGNATURE-----