Bugzilla – Attachment 129876 Details for
Bug 29956
Cookie can contain plain text password
Home
|
New
|
Browse
|
Search
|
[?]
|
Reports
|
Help
|
New Account
|
Log In
[x]
|
Forgot Password
Login:
[x]
[patch]
Bug 29956: Prevent login form to be serialized into cookie
Bug-29956-Prevent-login-form-to-be-serialized-into.patch (text/plain), 1.84 KB, created by
Jonathan Druart
on 2022-01-27 13:17:36 UTC
(
hide
)
Description:
Bug 29956: Prevent login form to be serialized into cookie
Filename:
MIME Type:
Creator:
Jonathan Druart
Created:
2022-01-27 13:17:36 UTC
Size:
1.84 KB
patch
obsolete
>From d2f3f5d9822a86400f37e6ce9a79e25997f547af Mon Sep 17 00:00:00 2001 >From: Jonathan Druart <jonathan.druart@bugs.koha-community.org> >Date: Thu, 27 Jan 2022 14:14:27 +0100 >Subject: [PATCH] Bug 29956: Prevent login form to be serialized into cookie > >To recrate: >Logout >Go to /cgi-bin/koha/opac-search.pl >Click "Log in to your account" >Fill in the login form >Submit >Check the 'form_serialized' cookie's value > >=> Without this patch it contain login/password >=> With this patch applied the cookie is not created > >Confirm that the "Return to the last advanced search" feature still >works as expected. >--- > koha-tmpl/opac-tmpl/bootstrap/en/modules/opac-advsearch.tt | 4 ++-- > 1 file changed, 2 insertions(+), 2 deletions(-) > >diff --git a/koha-tmpl/opac-tmpl/bootstrap/en/modules/opac-advsearch.tt b/koha-tmpl/opac-tmpl/bootstrap/en/modules/opac-advsearch.tt >index b4ac896084c..1d7f0d9f360 100644 >--- a/koha-tmpl/opac-tmpl/bootstrap/en/modules/opac-advsearch.tt >+++ b/koha-tmpl/opac-tmpl/bootstrap/en/modules/opac-advsearch.tt >@@ -9,7 +9,7 @@ > </head> > [% INCLUDE 'bodytag.inc' bodyid='advsearch' bodyclass='scrollto' %] > [% INCLUDE 'masthead.inc' %] >-<form action="/cgi-bin/koha/opac-search.pl" method="get"> >+<form id="advsearch_form" action="/cgi-bin/koha/opac-search.pl" method="get"> > <input type="hidden" name="advsearch" value="1"/> > <div class="main"> > <nav id="breadcrumbs" aria-label="Breadcrumb" class="breadcrumbs"> >@@ -500,7 +500,7 @@ $(document).ready(function() { > jQuery.removeCookie("form_serialized_limits", { path: '/'}); > jQuery.removeCookie("search_path_code", { path: '/'}); > [% END %] >- $('#advsearch form').submit(function() { >+ $('#advsearch_form').submit(function() { > $('[name^="limit"]').each(function(){ > if( $(this).val() == '' ){ > $(this).prop("disabled","disabled"); >-- >2.25.1
You cannot view the attachment while viewing its details because your browser does not support IFRAMEs.
View the attachment on a separate page
.
View Attachment As Diff
View Attachment As Raw
Actions:
View
|
Diff
|
Splinter Review
Attachments on
bug 29956
:
129876
|
129881
|
129893