Description:
------------
While on the PEAR site, I noticed that, without ever logging in myself, I was randomly logged in as someone else.
It should be noted that other log in/out bugs occur when users are logged in.  I was not logged in and I have never had a user account at the site.

Here's an email I sent to the gentleman whose identity I briefly took over:

Hello, Kevin.

On 11 Dec 2005 03:39:32 -0000, kevin cook <kevin@cookfamily.tv> wrote:

>> [This message has been brought to you via pear.php.net.]
>>
>> While browsing the PEAR site, I noticed that it said that I was logged
>> in as Anatoly Techtonik.
>>
>>
>>
>> How can this be?
>>


Frankly speaking, I do not know, because I do not have access to PEAR
website sources or to pear.php.net server. But I've seen Pierre
reported troubles with pearweb database and mentioned some cache
troubles recently, so it can be that id's in database messed up or
session cookies gone bad. The reasons for this mess can vary. It may
be security breach with XML-RPC in the past, bug in PEAR DB package,
some experimental code in pearweb or server misconfiguration
(cvs.php.net moved to a new server this morning).


>>
>>
>> Is this a bug in the site?
>>


Definitely. If you decide to report it you may attach this message. In
addition from my side - when I am on the main/documentation/news or
other static page I'm not logged in, but when I follow "login" page
pearweb tells me I'm already logged in. And I'm always logged in on
dynamic pages such as bugreporting or pepr proposal/package edition
pages.


>>
>>
>> Thought you should know.
>>


Thank you.

--
--t.