OT: reply

Posted Feb 19, 2008 8:09 UTC (Tue) by intgr (subscriber, #39733)
In reply to: OT: reply by intgr
Parent article: vmsplice(): the making of a local root exploit

So it turns out that this indeed is the problem; the stylesheet file sizes only differ in one byte so I didn't catch the difference the first time (I thought they were equal).

--- lwn_logged_out.css  2008-02-19 09:58:38.000000000 +0200
+++ lwn_logged_in.css   2008-02-19 09:57:04.000000000 +0200
@@ -135,7 +135,7 @@
 DIV.CommentBody { padding: 0px 4px 0px 4px; }
 P.CommentPoster { margin-top: 0px; }

-div.CommentReplyButton { display: none;
+div.CommentReplyButton { display: block;
                         text-align: right;
                         padding: 4px; }

The problem here is browser cache. When the user first visits LWN.net, not having logged in yet, the browser downloads /CSS/lwn which specifies that div.CommentReplyButton should be hidden.

Later when the user does log in, the browser doesn't bother re-fetching the stylesheet because it already has this URL cached. The Right Way to fix this is to have different stylesheet URLs depending on whether the user is logged in -- rather than using magic stylesheets.