[Bug 47005] Re: 'Switch User' button from 'System/Quit' should behave exactly like 'Switch User' from gnome-screensaver

2006-05-28 Thread Julian Yap
Under Breezy, the 'Switch User' used gdmflexiserver. This gives you a list of already open displays (and hence logged in users). So yes, I agree that this is a bug in the Gnome-session logout screen logic in that it doesn't query currently logged in users. -- 'Switch User' button from 'System/Q

[Bug 47005] Re: 'Switch User' button from 'System/Quit' should behave exactly like 'Switch User' from gnome-screensaver

2006-06-04 Thread Julian Yap
Upon further testing: Yes, it doesn't lock the screen once a user is switched. This is a security flaw as another logged in user just needs to switch virtual consoles to be in the other person's login. Logic currently: 1. User 'A' logs in. 2. Switch user and login as 'B'. 3. Switch user. Return

[Bug 48450] Security flaw that current session is NOT locked when switch user is invoked

2006-06-04 Thread Julian Yap
Public bug reported: This also relate to Launchpad bug 47005 where I have added additional comments. To reproduce bug: 1. Log in as user 'A'. X session starts up on Virtual Console 7. 2. Invoke the 'Quit...' dialog. 3. Click on 'Switch User'. Another GDM login screen is started up on Virtual C