Google Web Accelerator & Olympus

[expert01]

I've noticed Olympus has some new features over the 2.x version of phpBB. Do these features prevent the Google Web Accelerator bug (of users accessing pages only other users can see)? Has anyone tested?

[DeadEye686]

I've noticed Olympus has some new features over the 2.x version of phpBB. Do these features prevent the Google Web Accelerator bug (of users accessing pages only other users can see)? Has anyone tested?

To my knowledge, there's absolutely nothing that can prevent this bug except for Google fixing it.

Edit: Let me give my reasoning for that, so that someone can correct me if I'm incorrect. The problem currently is that if GoogleWA finds a cached version of the "private" page on its servers (it's actually more complicated than this, as there are a couple of algorithms to determine whether this happens - these algorithms need major tweaking at the moment), then it simply doesn't even contact the server with phpBB, it just serves the user the page found in its cache. Therefore, short of not providing the private page to an authenticated user (and thusly passing it into the GoogleWA cache if the user is using it), there is nothing that phpBB could do to prevent it.

[expert01]

Does having the ?sid= change the pages so they're not cached?

[A_Jelly_Doughnut]

Google does indeed cache Olympus's pages, even with the SID. I'm not sure that it is a big deal with phpBB, though, from what I've read on Accelerator. phpBB uses real confirm options, not javascript.

[expert01]

I meant will it change so that when you go to an Olympus forum the ?sid= is different for you and you won't see stuff you're not supposed to.

[nezermundy]

The porblem is Google could automaticly log you into the site as some one else, even an admin!

[the_dan]

The porblem is Google could automaticly log you into the site as some one else, even an admin!

It won't log you in - You just mioght be able to view sections of it. You can't make any changes etc.

[Cap'n Refsmmat]

I've heard of people being able to read other people's PMs with it.

[psoTFX]

Indeed, quite possible ... but you'll get nowhere if you try and POST anything via a cached page. At that stage it'll require you to reauthenticate as appropriate.

[stubbers]

So wait, google can cache restricted sub-forums, can't you lock google out using permissions