diff --git a/gnome-session-2.17.2-http-proxy.patch b/gnome-session-2.17.2-http-proxy.patch
new file mode 100644
index 0000000..ffa6132
--- /dev/null
+++ b/gnome-session-2.17.2-http-proxy.patch
@@ -0,0 +1,89 @@
+--- gnome-session-2.17.2/gnome-session/gsm-proxy.c.http-proxy	2006-11-27 00:36:17.000000000 -0500
++++ gnome-session-2.17.2/gnome-session/gsm-proxy.c	2006-11-27 00:36:47.000000000 -0500
+@@ -38,7 +38,7 @@ gsm_set_up_legacy_proxy_environment (voi
+ {
+   static gboolean run_before = FALSE;
+   gboolean use_proxy, use_authentication;
+-  char *host, *user_name, *password, *http_proxy;
++  char *host, *http_proxy;
+   gint port;
+   GConfClient *gconf_client;
+ 
+@@ -62,52 +62,34 @@ gsm_set_up_legacy_proxy_environment (voi
+       return;
+     }
+ 
++  use_authentication = gconf_client_get_bool (gconf_client, HTTP_PROXY_AUTHENTICATION_KEY, NULL);
++
++  /* we don't bother if a username/password are set since keeping the password
++   * in an environment variable has security ramifications
++   */
++  if (use_authentication)
++    {
++      g_unsetenv ("http_proxy"); 
++      return;
++    }
++
+   host = gconf_client_get_string (gconf_client, HTTP_PROXY_HOST_KEY, NULL);
+ 
+   if (host == NULL || host[0] == '\0')
+     {
++      g_free (host);
+       g_unsetenv ("http_proxy");
+       return;
+     }
+ 
+   port = gconf_client_get_int (gconf_client, HTTP_PROXY_PORT_KEY, NULL);
+ 
+-  use_authentication = gconf_client_get_bool (gconf_client, HTTP_PROXY_AUTHENTICATION_KEY, NULL);
+-
+-  user_name = NULL;
+-  password = NULL;
+-  if (use_authentication)
+-    {
+-      user_name = gconf_client_get_string (gconf_client, HTTP_PROXY_USER_NAME_KEY, 
+-                                           NULL);
+-      if (user_name != NULL && user_name[0] == '\0')
+-        {
+-          g_free (user_name);
+-          user_name = NULL;
+-        }
+-      else 
+-        password = gconf_client_get_string (gconf_client, HTTP_PROXY_PASSWORD_KEY, 
+-                                          NULL);
+-    }
+-
+   if (port <= 0)
+-    http_proxy = g_strdup_printf ("http://%s%s%s%s%s",
+-                                  user_name != NULL? user_name : "",
+-                                  user_name != NULL && password != NULL? "@" : "",
+-                                  user_name != NULL && password != NULL? password : "",
+-                                  user_name != NULL? ":" : "",
+-                                  host); 
++    http_proxy = g_strdup_printf ("http://%s", host); 
+   else
+-    http_proxy = g_strdup_printf ("http://%s%s%s%s%s:%d",
+-                                  user_name != NULL? user_name : "",
+-                                  user_name != NULL && password != NULL? "@" : "",
+-                                  user_name != NULL && password != NULL? password : "",
+-                                  user_name != NULL? ":" : "",
+-                                  host, port); 
++    http_proxy = g_strdup_printf ("http://%s:%d", host, port); 
+   g_setenv ("http_proxy", http_proxy, TRUE);
+ 
+   g_free (http_proxy);
+-  g_free (password);
+-  g_free (user_name);
+   g_free (host);
+ }
+--- gnome-session-2.17.2/gnome-session/headers.h.http-proxy	2006-10-26 21:19:45.000000000 -0400
++++ gnome-session-2.17.2/gnome-session/headers.h	2006-11-27 00:36:47.000000000 -0500
+@@ -78,8 +78,6 @@
+ #define HTTP_PROXY_PREFIX             "/system/http_proxy"
+ #define HTTP_PROXY_KEY                HTTP_PROXY_PREFIX "/use_http_proxy"
+ #define HTTP_PROXY_AUTHENTICATION_KEY HTTP_PROXY_PREFIX "/use_authentication"
+-#define HTTP_PROXY_USER_NAME_KEY      HTTP_PROXY_PREFIX "/authentication_user"
+-#define HTTP_PROXY_PASSWORD_KEY       HTTP_PROXY_PREFIX "/authentication_password"
+ #define HTTP_PROXY_HOST_KEY           HTTP_PROXY_PREFIX "/host"
+ #define HTTP_PROXY_PORT_KEY           HTTP_PROXY_PREFIX "/port"
+ 
diff --git a/gnome-session.spec b/gnome-session.spec
index 3a8244d..e8419c3 100644
--- a/gnome-session.spec
+++ b/gnome-session.spec
@@ -14,7 +14,7 @@
 Summary: GNOME session manager
 Name: gnome-session
 Version: 2.17.2
-Release: 5%{?dist}
+Release: 6%{?dist}
 URL: http://www.gnome.org
 Source0: %{name}-%{version}.tar.bz2
 Source1: redhat-default-session
@@ -59,6 +59,9 @@ Patch12: gnome-session-2.15.91-desensitize-invalid-buttons.patch
 # http://bugzilla.gnome.org/show_bug.cgi?id=350848
 Patch13: gnome-session-2.15.91-window-manager.patch
 
+# http://bugzilla.gnome.org/show_bug.cgi?id=84315
+Patch14: gnome-session-2.17.2-http-proxy.patch
+
 BuildRequires: glib2-devel >= %{glib2_version}
 BuildRequires: pango-devel >= %{pango_version}
 BuildRequires: gtk2-devel >= %{gtk2_version}
@@ -102,6 +105,7 @@ GNOME components and handles logout and saving the session.
 %patch9 -p1 -b .no-crashes
 %patch12 -p1 -b .desensitize-invalid-buttons
 %patch13 -p1 -b .window-manager
+%patch14 -p1 -b .http-proxy
 
 %build
 
@@ -193,7 +197,7 @@ fi
 %{_datadir}/gnome/wm-properties
 
 %changelog
-* Mon Nov 27 2006 Ray Strode <rstrode@redhat.com> - 2.17.2-5
+* Mon Nov 27 2006 Ray Strode <rstrode@redhat.com> - 2.17.2-6
 - don't set http_proxy variable if proxy requires password (bug
   217332)