Bug Report: Cookie Path Mismatch

  • Hi! Here with another bug report found in wp-content/plugins/breeze/inc/functions.php. In the current implementation, the BREEZE_WP_COOKIE breeze_folder_name is being set using the COOKIEPATH constant. However, when it is being removed as part of breeze_auth_cookie_clear(), it is being cleared using SITECOOKIEPATH. On some installs, these two constants might be different. Breeze should be consistent with the usage to make sure the cookie gets unset correctly. Hope that helps.

Viewing 2 replies - 1 through 2 (of 2 total)
  • Plugin Author adeelkhan

    (@adeelkhan)

    Hi

    It would be more helpful to explain the point “it is being cleared using?SITECOOKIEPATH. On some installs, these two constants might be different”

    Thanks

    Thread Starter David Bee

    (@davidbawiec)

    By default, the COOKIEPATH constant creates the path using get_option( 'home' ). On the other hand, the SITECOOKIEPATH constant is created using get_option( 'siteurl' ). For some WordPress sites, these two paths are not the same URL (for example, if the site is installed in a sub-directory, one cookie path would be “/”, and the other cookie path could be “/sub-directory/”).

    The important thing is that there’s a problem in the code in wp-content/plugins/breeze/inc/functions.php:

    On line 237 and line 277, you use COOKIEPATH. But on line 247 you accidentally use SITECOOKIEPATH. This should be COOKIEPATH as well.

    Hope this helps fix the code.

Viewing 2 replies - 1 through 2 (of 2 total)
  • The topic ‘Bug Report: Cookie Path Mismatch’ is closed to new replies.