Bugzilla – Attachment 129881 Details for
Bug 29956
Cookie can contain plain text password
Home
|
New
|
Browse
|
Search
|
[?]
|
Reports
|
Help
|
New Account
|
Log In
[x]
|
Forgot Password
Login:
[x]
[patch]
Bug 29956: Prevent login form to be serialized into cookie
Bug-29956-Prevent-login-form-to-be-serialized-into.patch (text/plain), 1.89 KB, created by
Nick Clemens (kidclamp)
on 2022-01-27 13:37:43 UTC
(
hide
)
Description:
Bug 29956: Prevent login form to be serialized into cookie
Filename:
MIME Type:
Creator:
Nick Clemens (kidclamp)
Created:
2022-01-27 13:37:43 UTC
Size:
1.89 KB
patch
obsolete
>From 0412f5614deb42f320c438f31bd2c9d26b9b8f10 Mon Sep 17 00:00:00 2001 >From: Jonathan Druart <jonathan.druart@bugs.koha-community.org> >Date: Thu, 27 Jan 2022 14:14:27 +0100 >Subject: [PATCH] Bug 29956: Prevent login form to be serialized into cookie > >To recrate: >Logout >Go to /cgi-bin/koha/opac-search.pl >Click "Log in to your account" >Fill in the login form >Submit >Check the 'form_serialized' cookie's value > >=> Without this patch it contain login/password >=> With this patch applied the cookie is not created > >Confirm that the "Return to the last advanced search" feature still >works as expected. > >Signed-off-by: Nick Clemens <nick@bywatersolutions.com> >--- > koha-tmpl/opac-tmpl/bootstrap/en/modules/opac-advsearch.tt | 4 ++-- > 1 file changed, 2 insertions(+), 2 deletions(-) > >diff --git a/koha-tmpl/opac-tmpl/bootstrap/en/modules/opac-advsearch.tt b/koha-tmpl/opac-tmpl/bootstrap/en/modules/opac-advsearch.tt >index b4ac896084..1d7f0d9f36 100644 >--- a/koha-tmpl/opac-tmpl/bootstrap/en/modules/opac-advsearch.tt >+++ b/koha-tmpl/opac-tmpl/bootstrap/en/modules/opac-advsearch.tt >@@ -9,7 +9,7 @@ > </head> > [% INCLUDE 'bodytag.inc' bodyid='advsearch' bodyclass='scrollto' %] > [% INCLUDE 'masthead.inc' %] >-<form action="/cgi-bin/koha/opac-search.pl" method="get"> >+<form id="advsearch_form" action="/cgi-bin/koha/opac-search.pl" method="get"> > <input type="hidden" name="advsearch" value="1"/> > <div class="main"> > <nav id="breadcrumbs" aria-label="Breadcrumb" class="breadcrumbs"> >@@ -500,7 +500,7 @@ $(document).ready(function() { > jQuery.removeCookie("form_serialized_limits", { path: '/'}); > jQuery.removeCookie("search_path_code", { path: '/'}); > [% END %] >- $('#advsearch form').submit(function() { >+ $('#advsearch_form').submit(function() { > $('[name^="limit"]').each(function(){ > if( $(this).val() == '' ){ > $(this).prop("disabled","disabled"); >-- >2.30.2
You cannot view the attachment while viewing its details because your browser does not support IFRAMEs.
View the attachment on a separate page
.
View Attachment As Diff
View Attachment As Raw
Actions:
View
|
Diff
|
Splinter Review
Attachments on
bug 29956
:
129876
|
129881
|
129893