|Subject:||LiveObject caching may return results from other DBs when using custom db_Main|
Class::DBI 0.96 Perl 5.8.0 RedHat 2.4.21-15.ELsmp Apache 2.0.46 mod_perl 1.99 My mod_perl2 application uses a custom db_Main method to connect to a database based on some information in the URL. The app may be called with, say, db=STORE_1 or db=STORE_2. The %Live_Objects caching introduced in CDB 0.96 uses the class name and primary keys to identify cached objects but does not pay attention to which DB instance the object belongs. Problem: In a persisted environment (mod_perl), if I retrieve an object with ID 123 from the STORE_1 database, it will be cached and subsequent queries for object with ID 123 in the STORE_2 database (or any other database accessed with this class) will return the cached object. This is incorrect behavior and a potential SECURITY HOLE since users of STORE_2 may now see data from STORE_1 without authorization. My Workaround: Use Class::CGI 0.95 which does not exhibit this problem. Solution: You should incorporate the dbh returned by $class->db_Main as part of the key used in identifying LiveObjects.