Critical Security: User sees *other* users chat bar

[cgdutoit]

Hi - I have a fairly serious issue here and would like some pointers. To be clear, I don't believe it is necessarily a arrowchat bug, but I'm getting mixed sessions.

Today a user of my forum (IPBoard) suddenly saw someone elses arrow chat bar...ie. The chat bar for a different user appeared on her screen. I saw this in the screenshot. And messages she sent in this chat session were indeed attributed to this other user.

Upon investigation, I see that both users had the same IP address! And somehow, this seemed to confuse Arrowchat so that one user was working with another users chat.

This is obviously a critical security hole, but I don't know what the issue may be me. It must clearly be related to the fact that two users had the same IP address (although one was in Wales and one in the US). And while this should not happen, it looks like the chat session has no unique session key? Is there something I can do that would prevent this?

Thanks for any insight
Chris

[Jason]

ArrowChat uses IPB to recognize a user, not an IP address, so they would have to of been logged in as that user.

[Staff Bot]

[b]This thread has been locked because the last post is greater than six months old. There is a good chance that the information in this thread is outdated. Please open a new topic if you wish to discuss this further.[/b]