On 02/13/2012 11:47 AM, Ricardo.Julio.Rodriguez.Fernandez(a)sergas.es wrote: This should not happen from XWiki. Do you have any other proxies, frontends, or even a simple browser cache that is serving the file without asking XWiki for it? -- Sergiu Dumitriu http://purl.org/net/sergiu/

-- Ricardo Rodríguez Research Management and Promotion Technician Health Research Institute of Santiago de Compostela (IDIS) http://www.idisantiago.es ________________________________________ From: users-bounces(a)xwiki.org [users-bounces(a)xwiki.org] On Behalf Of Vincent Massol [vincent(a)massol.net] Sent: 13 February 2012 18:09 To: XWiki Users Subject: Re: [xwiki-users] security breach? On Feb 13, 2012, at 5:47 PM, <Ricardo.Julio.Rodriguez.Fernandez(a)sergas.es> <Ricardo.Julio.Rodriguez.Fernandez(a)sergas.es> wrote: Hi, Vincent, No, I've not been able to reproduce it yet. The issue arose sometime ago when an user claims that a paper of him, ready to be published by a first line magazine, appears indexed by Google even though it was theoretically protected within a XWiki installation. Please, check this: http://atrium_km.idisantiago.es/bin/Project/Transcan2012 - you must be required to identify http://atrium_km.idisantiago.es/bin/download/Project/Transcan2012/S28BW.num… - at least from my browsers here, this image is freely accessible... some cache related issue? http://atrium_km.idisantiago.es/bin/download/Project/Transcan2012/idisMotto… - you are required to identiy; this file is attached to the same page! Vincent, do you remember your account at EPEC Network? Atrium_KM is now the controller of the whole farm. I've chaged eBioTIC. look and feel to fit the image requirements of this new initiative. I do hope I'll be able to get it bak ASAP! I've created a new account for you there and I'm sending you a new password. Thanks! Ricardo _______________________________________________ users mailing list users(a)xwiki.org http://lists.xwiki.org/mailman/listinfo/users Nota: A información contida nesta mensaxe e os seus posibles documentos adxuntos é privada e confidencial e está dirixida únicamente ó seu destinatario/a. Se vostede non é o/a destinatario/a orixinal desta mensaxe, por favor elimínea. A distribución ou copia desta mensaxe non está autorizada. Nota: La información contenida en este mensaje y sus posibles documentos adjuntos es privada y confidencial y está dirigida únicamente a su destinatario/a. Si usted no es el/la destinatario/a original de este mensaje, por favor elimínelo. La distribución o copia de este mensaje no está autorizada. See more languages: http://www.sergas.es/aviso_confidencialidad.htm

On 02/13/2012 05:08 PM, Ricardo.Julio.Rodriguez.Fernandez(a)sergas.es wrote: I'm prompted for a login for both images. Try to clear your browser cache and see if you can still see the image. Are you sure that Google got the paper from that page? Are you sure it didn't get it at a time when the document was freely accessible? -- Sergiu Dumitriu http://purl.org/net/sergiu/

Le 13 févr. 2012 à 23:31, Ricardo.Julio.Rodriguez.Fernandez(a)sergas.es a écrit : Search for the Set-Cookie header. Sure, especially if you activate the detailed login. They all require login by me. Have you cleared the cookies? paul

Hi! ________________________________________ From: users-bounces(a)xwiki.org [users-bounces(a)xwiki.org] On Behalf Of Paul Libbrecht [paul(a)hoplahup.net] Sent: 13 February 2012 23:34 To: XWiki Users Subject: Re: [xwiki-users] security breach? Le 13 févr. 2012 à 23:31, Ricardo.Julio.Rodriguez.Fernandez(a)sergas.es a écrit : OK. I'm afraid I've to read some more documentation about cookies before being able to understand what is an error and what simply a record of regular activity! Ominweb is working OK for me now. Firefox, Safari and Chrome are failing to show the correct behaviour even though I've cleared cache and removed cookies... there is something I'm not able to understand here. What seems clear is that is not a XWiki related issue! What is great... Could XWiki do anything better to ease the way browsers behave? Thanks! Ricardo -- Ricardo Rodríguez Research Management and Promotion Technician Health Research Institute of Santiago de Compostela (IDIS) http://www.idisantiago.es _______________________________________________ users mailing list users(a)xwiki.org http://lists.xwiki.org/mailman/listinfo/users Nota: A información contida nesta mensaxe e os seus posibles documentos adxuntos é privada e confidencial e está dirixida únicamente ó seu destinatario/a. Se vostede non é o/a destinatario/a orixinal desta mensaxe, por favor elimínea. A distribución ou copia desta mensaxe non está autorizada. Nota: La información contenida en este mensaje y sus posibles documentos adjuntos es privada y confidencial y está dirigida únicamente a su destinatario/a. Si usted no es el/la destinatario/a original de este mensaje, por favor elimínelo. La distribución o copia de este mensaje no está autorizada. See more languages: http://www.sergas.es/aviso_confidencialidad.htm

Thanks, Nicolas. -- Ricardo Rodríguez Research Management and Promotion Technician Health Research Institute of Santiago de Compostela (IDIS) http://www.idisantiago.es ________________________________________ From: users-bounces(a)xwiki.org [users-bounces(a)xwiki.org] On Behalf Of Nicolas Grégoire [nicolas.gregoire(a)agarri.fr] Sent: 14 February 2012 00:00 To: XWiki Users Subject: Re: [xwiki-users] security breach? Nope, to the best of my knowledge. It seems to me that only a misfunctioning of my local browsers/cache can explain this behavior. Thanks for your help! _______________________________________________ users mailing list users(a)xwiki.org http://lists.xwiki.org/mailman/listinfo/users Nota: A información contida nesta mensaxe e os seus posibles documentos adxuntos é privada e confidencial e está dirixida únicamente ó seu destinatario/a. Se vostede non é o/a destinatario/a orixinal desta mensaxe, por favor elimínea. A distribución ou copia desta mensaxe non está autorizada. Nota: La información contenida en este mensaje y sus posibles documentos adjuntos es privada y confidencial y está dirigida únicamente a su destinatario/a. Si usted no es el/la destinatario/a original de este mensaje, por favor elimínelo. La distribución o copia de este mensaje no está autorizada. See more languages: http://www.sergas.es/aviso_confidencialidad.htm

Thanks Paul, _______________ From: users-bounces(a)xwiki.org [users-bounces(a)xwiki.org] On Behalf Of Paul Libbrecht [paul(a)hoplahup.net] Sent: 14 February 2012 09:32 To: XWiki Users Subject: Re: [xwiki-users] security breach? Le 14 févr. 2012 à 00:09, Ricardo.Julio.Rodriguez.Fernandez(a)sergas.es a écrit : >> Is there a specific proxy, cache, reverse-proxy, load-balancer or SSL >> accelerator between you and the website ? > Nope, to the best of my knowledge. It seems to me that only a misfunctioning of my local browsers/cache can explain this behavior. >>> Ricardo, >>>>> not having a proxy would mean that you'd run the servlet container (tomcat, jetty, ...) as root or at least start it as such. This is rarely done. >>>>> paul You are right: this way of doing things is not included in any best practices guide. It has been a heritage of old times I've been not able to change yet. I do hope I'll be able to get a better environment to run XWiki in the near future. And apologize for any noise I can introduce in the list by doing things this way. Thank you so much for your comments, Ricardo -- Ricardo Rodríguez Research Management and Promotion Technician Health Research Institute of Santiago de Compostela (IDIS) http://www.idisantiago.es _______________________________________________ users mailing list users(a)xwiki.org http://lists.xwiki.org/mailman/listinfo/users Nota: A información contida nesta mensaxe e os seus posibles documentos adxuntos é privada e confidencial e está dirixida únicamente ó seu destinatario/a. Se vostede non é o/a destinatario/a orixinal desta mensaxe, por favor elimínea. A distribución ou copia desta mensaxe non está autorizada. Nota: La información contenida en este mensaje y sus posibles documentos adjuntos es privada y confidencial y está dirigida únicamente a su destinatario/a. Si usted no es el/la destinatario/a original de este mensaje, por favor elimínelo. La distribución o copia de este mensaje no está autorizada. See more languages: http://www.sergas.es/aviso_confidencialidad.htm