Fixing of an authentication security problem that could in some case permit a user to usurp identity of an other user. This is almost an utopia case, but it is possible.
This problem can also make thinking the users on the fact that Silverpeas would not be a serious application.
To obtain the authentication mistake :
- logon successfully with an administrator
- after that, fill the URL address of the Web navigator : http(s)://[server host][: server port]/silverpeas/ (not click on disconnect)
- you are now on the login page. Now, logon with an other user that is not an administrator
- do you see what i saw ?