Major Security Hole Fixed!

Attention all Geeklog 1.3 Admins

I hope you programmers out there never have to do what I'm about to do. A security hole has been brought to my attention and all Geeklog 1.3 admins will need to apply this fix. Luckily a 'good guy' found this before it became is big issue.

During all the session management changes from a while back I neglected to add back the MD5 hash of the users password to a cookie and check that. As a result, it is possible to have your Geeklog 1.3 system compromised by simply editing the cookie and changing the user ID to that of a Geeklog admin. This hole is about as critical as a hole can get. If you are running Geeklog 1.3 you will need to go to CVS and download the latest copies of system/lib-sessions.php and public_html/users.php.