Bug 29956

Summary: Cookie can contain plain text password
Product: Koha Reporter: Jonathan Druart <jonathan.druart>
Component: Architecture, internals, and plumbingAssignee: Jonathan Druart <jonathan.druart>
Status: Pushed to oldoldoldstable --- QA Contact: Marcel de Rooy <m.de.rooy>
Severity: critical    
Priority: P5 - low CC: 1joynelson, dcook, fridolin.somers, jonathan.druart, lucas, m.de.rooy, nick, ulrich.kleiber, victor, wainuiwitikapark
Version: unspecified   
Hardware: All   
OS: All   
Change sponsored?: --- Patch complexity: Trivial patch
Documentation contact: Documentation submission:
Text to go in the release notes:
Version(s) released in:
22.05.00,21.11.03,21.05.12,20.11.16,19.11.27
Circulation function:
Attachments: Bug 29956: Prevent login form to be serialized into cookie
Bug 29956: Prevent login form to be serialized into cookie
Bug 29956: Prevent login form to be serialized into cookie

Description Jonathan Druart 2022-01-27 10:33:21 UTC
Yes, not a joke.
Comment 1 Jonathan Druart 2022-01-27 13:17:36 UTC
Created attachment 129876 [details] [review]
Bug 29956: Prevent login form to be serialized into cookie

To recrate:
Logout
Go to /cgi-bin/koha/opac-search.pl
Click "Log in to your account"
Fill in the login form
Submit
Check the 'form_serialized' cookie's value

=> Without this patch it contain login/password
=> With this patch applied the cookie is not created

Confirm that the "Return to the last advanced search" feature still
works as expected.
Comment 2 Nick Clemens (kidclamp) 2022-01-27 13:37:43 UTC
Created attachment 129881 [details] [review]
Bug 29956: Prevent login form to be serialized into cookie

To recrate:
Logout
Go to /cgi-bin/koha/opac-search.pl
Click "Log in to your account"
Fill in the login form
Submit
Check the 'form_serialized' cookie's value

=> Without this patch it contain login/password
=> With this patch applied the cookie is not created

Confirm that the "Return to the last advanced search" feature still
works as expected.

Signed-off-by: Nick Clemens <nick@bywatersolutions.com>
Comment 3 Marcel de Rooy 2022-01-27 14:27:36 UTC
(In reply to Nick Clemens from comment #2)

Great. Time for QA !
Comment 4 Marcel de Rooy 2022-01-27 14:44:39 UTC
Created attachment 129893 [details] [review]
Bug 29956: Prevent login form to be serialized into cookie

To recrate:
Logout
Go to /cgi-bin/koha/opac-search.pl
Click "Log in to your account"
Fill in the login form
Submit
Check the 'form_serialized' cookie's value

=> Without this patch it contain login/password
=> With this patch applied the cookie is not created

Confirm that the "Return to the last advanced search" feature still
works as expected.

Signed-off-by: Nick Clemens <nick@bywatersolutions.com>

Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl>
Comment 5 Martin Renvoize (ashimema) 2022-01-27 16:08:49 UTC
Yikes, that's scary..

Also confirmed the patch here works.. nice work team
Comment 6 Wainui Witika-Park 2022-02-15 03:30:09 UTC
Backported to 19.11.x-security
Comment 7 Victor Grousset/tuxayo 2022-03-11 04:42:11 UTC
Backported: Pushed to 20.11.x-security branch for 20.11.16
Comment 8 Fridolin Somers 2022-03-16 08:10:18 UTC
Pushed to master for 22.05