Summary: | Cookie can contain plain text password | ||
---|---|---|---|
Product: | Koha | Reporter: | Jonathan Druart <jonathan.druart> |
Component: | Architecture, internals, and plumbing | Assignee: | Jonathan Druart <jonathan.druart> |
Status: | Pushed to oldoldoldstable --- | QA Contact: | Marcel de Rooy <m.de.rooy> |
Severity: | critical | ||
Priority: | P5 - low | CC: | 1joynelson, dcook, fridolin.somers, jonathan.druart, lucas, m.de.rooy, nick, ulrich.kleiber, victor, wainuiwitikapark |
Version: | unspecified | ||
Hardware: | All | ||
OS: | All | ||
Change sponsored?: | --- | Patch complexity: | Trivial patch |
Documentation contact: | Documentation submission: | ||
Text to go in the release notes: | Version(s) released in: |
22.05.00,21.11.03,21.05.12,20.11.16,19.11.27
|
|
Circulation function: | |||
Attachments: |
Bug 29956: Prevent login form to be serialized into cookie
Bug 29956: Prevent login form to be serialized into cookie Bug 29956: Prevent login form to be serialized into cookie |
Description
Jonathan Druart
2022-01-27 10:33:21 UTC
Created attachment 129876 [details] [review] Bug 29956: Prevent login form to be serialized into cookie To recrate: Logout Go to /cgi-bin/koha/opac-search.pl Click "Log in to your account" Fill in the login form Submit Check the 'form_serialized' cookie's value => Without this patch it contain login/password => With this patch applied the cookie is not created Confirm that the "Return to the last advanced search" feature still works as expected. Created attachment 129881 [details] [review] Bug 29956: Prevent login form to be serialized into cookie To recrate: Logout Go to /cgi-bin/koha/opac-search.pl Click "Log in to your account" Fill in the login form Submit Check the 'form_serialized' cookie's value => Without this patch it contain login/password => With this patch applied the cookie is not created Confirm that the "Return to the last advanced search" feature still works as expected. Signed-off-by: Nick Clemens <nick@bywatersolutions.com> (In reply to Nick Clemens from comment #2) Great. Time for QA ! Created attachment 129893 [details] [review] Bug 29956: Prevent login form to be serialized into cookie To recrate: Logout Go to /cgi-bin/koha/opac-search.pl Click "Log in to your account" Fill in the login form Submit Check the 'form_serialized' cookie's value => Without this patch it contain login/password => With this patch applied the cookie is not created Confirm that the "Return to the last advanced search" feature still works as expected. Signed-off-by: Nick Clemens <nick@bywatersolutions.com> Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl> Yikes, that's scary.. Also confirmed the patch here works.. nice work team Backported to 19.11.x-security Backported: Pushed to 20.11.x-security branch for 20.11.16 Pushed to master for 22.05 |