{"action":"created","issue":{"url":"https://api.github.com/repos/nexcess/magento-turpentine/issues/714","labels_url":"https://api.github.com/repos/nexcess/magento-turpentine/issues/714/labels{/name}","comments_url":"https://api.github.com/repos/nexcess/magento-turpentine/issues/714/comments","events_url":"https://api.github.com/repos/nexcess/magento-turpentine/issues/714/events","html_url":"https://github.com/nexcess/magento-turpentine/issues/714","id":53343513,"number":714,"title":"Ugly issue - Online Customers section in Admin is compromised","user":{"login":"ADDISON74","id":8360474,"avatar_url":"https://avatars.githubusercontent.com/u/8360474?v=3","gravatar_id":"","url":"https://api.github.com/users/ADDISON74","html_url":"https://github.com/ADDISON74","followers_url":"https://api.github.com/users/ADDISON74/followers","following_url":"https://api.github.com/users/ADDISON74/following{/other_user}","gists_url":"https://api.github.com/users/ADDISON74/gists{/gist_id}","starred_url":"https://api.github.com/users/ADDISON74/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/ADDISON74/subscriptions","organizations_url":"https://api.github.com/users/ADDISON74/orgs","repos_url":"https://api.github.com/users/ADDISON74/repos","events_url":"https://api.github.com/users/ADDISON74/events{/privacy}","received_events_url":"https://api.github.com/users/ADDISON74/received_events","type":"User","site_admin":false},"labels":[],"state":"open","locked":false,"assignee":null,"milestone":null,"comments":12,"created_at":"2015-01-04T18:12:06Z","updated_at":"2015-01-09T10:19:24Z","closed_at":null,"body":"Go to Backend and from [Customers] menu choose [Online Customers]. Watch URL column, it is compromised as information. 24 records all with turpentine in url for the same ip. After a while and some refreshes it will remain only one URL, also with turpentine text in URL. Here is an example from my test localhost:\r\n\r\nhttp://192.168.159.131/turpentine/esi/getBlock/method/esi/access/public/ttl/3600/hmac/c2b8547cb6feec581e62213af326e05c9ad9c057716ea153892b5ce5664a84d2/data/ahlJpOZh6So05ByE.Xp2gC98.HR.9i7FudWMsOQbmfqEGZscaOmtlZuMhmY17YS9fpF7qcIyd9NiK6XFfp587nqAwVnJXt\r\n\r\nAs this URL is you cannot understand anything a visitor is doing inside the website.\r\n\r\n"},"comment":{"url":"https://api.github.com/repos/nexcess/magento-turpentine/issues/comments/69316565","html_url":"https://github.com/nexcess/magento-turpentine/issues/714#issuecomment-69316565","issue_url":"https://api.github.com/repos/nexcess/magento-turpentine/issues/714","id":69316565,"user":{"login":"ADDISON74","id":8360474,"avatar_url":"https://avatars.githubusercontent.com/u/8360474?v=3","gravatar_id":"","url":"https://api.github.com/users/ADDISON74","html_url":"https://github.com/ADDISON74","followers_url":"https://api.github.com/users/ADDISON74/followers","following_url":"https://api.github.com/users/ADDISON74/following{/other_user}","gists_url":"https://api.github.com/users/ADDISON74/gists{/gist_id}","starred_url":"https://api.github.com/users/ADDISON74/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/ADDISON74/subscriptions","organizations_url":"https://api.github.com/users/ADDISON74/orgs","repos_url":"https://api.github.com/users/ADDISON74/repos","events_url":"https://api.github.com/users/ADDISON74/events{/privacy}","received_events_url":"https://api.github.com/users/ADDISON74/received_events","type":"User","site_admin":false},"created_at":"2015-01-09T10:19:24Z","updated_at":"2015-01-09T10:19:24Z","body":"In my opinion an investigation should start related to this Online Customer module and how Turpentine affects the URL this module is processing. It is clear to me Turpentine is passing the URLs and this module just show them, like an array."}}