Bugzilla – Attachment 129893 Details for
Bug 29956
Cookie can contain plain text password
Home
|
New
|
Browse
|
Search
|
[?]
|
Reports
|
Help
|
New Account
|
Log In
[x]
|
Forgot Password
Login:
[x]
[patch]
Bug 29956: Prevent login form to be serialized into cookie
Bug-29956-Prevent-login-form-to-be-serialized-into.patch (text/plain), 1.99 KB, created by
Marcel de Rooy
on 2022-01-27 14:44:39 UTC
(
hide
)
Description:
Bug 29956: Prevent login form to be serialized into cookie
Filename:
MIME Type:
Creator:
Marcel de Rooy
Created:
2022-01-27 14:44:39 UTC
Size:
1.99 KB
patch
obsolete
>From 570d20aee1131e8c4ea76a6b0b6e866c1beecb9a Mon Sep 17 00:00:00 2001 >From: Jonathan Druart <jonathan.druart@bugs.koha-community.org> >Date: Thu, 27 Jan 2022 14:14:27 +0100 >Subject: [PATCH] Bug 29956: Prevent login form to be serialized into cookie >Content-Type: text/plain; charset=utf-8 > >To recrate: >Logout >Go to /cgi-bin/koha/opac-search.pl >Click "Log in to your account" >Fill in the login form >Submit >Check the 'form_serialized' cookie's value > >=> Without this patch it contain login/password >=> With this patch applied the cookie is not created > >Confirm that the "Return to the last advanced search" feature still >works as expected. > >Signed-off-by: Nick Clemens <nick@bywatersolutions.com> > >Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl> >--- > koha-tmpl/opac-tmpl/bootstrap/en/modules/opac-advsearch.tt | 4 ++-- > 1 file changed, 2 insertions(+), 2 deletions(-) > >diff --git a/koha-tmpl/opac-tmpl/bootstrap/en/modules/opac-advsearch.tt b/koha-tmpl/opac-tmpl/bootstrap/en/modules/opac-advsearch.tt >index b4ac896084..1d7f0d9f36 100644 >--- a/koha-tmpl/opac-tmpl/bootstrap/en/modules/opac-advsearch.tt >+++ b/koha-tmpl/opac-tmpl/bootstrap/en/modules/opac-advsearch.tt >@@ -9,7 +9,7 @@ > </head> > [% INCLUDE 'bodytag.inc' bodyid='advsearch' bodyclass='scrollto' %] > [% INCLUDE 'masthead.inc' %] >-<form action="/cgi-bin/koha/opac-search.pl" method="get"> >+<form id="advsearch_form" action="/cgi-bin/koha/opac-search.pl" method="get"> > <input type="hidden" name="advsearch" value="1"/> > <div class="main"> > <nav id="breadcrumbs" aria-label="Breadcrumb" class="breadcrumbs"> >@@ -500,7 +500,7 @@ $(document).ready(function() { > jQuery.removeCookie("form_serialized_limits", { path: '/'}); > jQuery.removeCookie("search_path_code", { path: '/'}); > [% END %] >- $('#advsearch form').submit(function() { >+ $('#advsearch_form').submit(function() { > $('[name^="limit"]').each(function(){ > if( $(this).val() == '' ){ > $(this).prop("disabled","disabled"); >-- >2.20.1
You cannot view the attachment while viewing its details because your browser does not support IFRAMEs.
View the attachment on a separate page
.
View Attachment As Diff
View Attachment As Raw
Actions:
View
|
Diff
|
Splinter Review
Attachments on
bug 29956
:
129876
|
129881
| 129893