Bug 29956 - Cookie can contain plain text password
Summary: Cookie can contain plain text password
Status: Pushed to oldoldoldstable
Alias: None
Product: Koha
Classification: Unclassified
Component: Architecture, internals, and plumbing (show other bugs)
Version: unspecified
Hardware: All All
: P5 - low critical (vote)
Assignee: Jonathan Druart
QA Contact: Marcel de Rooy
URL:
Keywords:
Depends on:
Blocks:
 
Reported: 2022-01-27 10:33 UTC by Jonathan Druart
Modified: 2022-03-16 08:17 UTC (History)
12 users (show)

See Also:
Change sponsored?: ---
Patch complexity: Trivial patch
Documentation contact:
Documentation submission:
Text to go in the release notes:
Version(s) released in:
22.05.00,21.11.03,21.05.12,20.11.16,19.11.27


Attachments
Bug 29956: Prevent login form to be serialized into cookie (1.84 KB, patch)
2022-01-27 13:17 UTC, Jonathan Druart
Details | Diff | Splinter Review
Bug 29956: Prevent login form to be serialized into cookie (1.89 KB, patch)
2022-01-27 13:37 UTC, Nick Clemens
Details | Diff | Splinter Review
Bug 29956: Prevent login form to be serialized into cookie (1.99 KB, patch)
2022-01-27 14:44 UTC, Marcel de Rooy
Details | Diff | Splinter Review

Note You need to log in before you can comment on or make changes to this bug.
Description Jonathan Druart 2022-01-27 10:33:21 UTC
Yes, not a joke.
Comment 1 Jonathan Druart 2022-01-27 13:17:36 UTC
Created attachment 129876 [details] [review]
Bug 29956: Prevent login form to be serialized into cookie

To recrate:
Logout
Go to /cgi-bin/koha/opac-search.pl
Click "Log in to your account"
Fill in the login form
Submit
Check the 'form_serialized' cookie's value

=> Without this patch it contain login/password
=> With this patch applied the cookie is not created

Confirm that the "Return to the last advanced search" feature still
works as expected.
Comment 2 Nick Clemens 2022-01-27 13:37:43 UTC
Created attachment 129881 [details] [review]
Bug 29956: Prevent login form to be serialized into cookie

To recrate:
Logout
Go to /cgi-bin/koha/opac-search.pl
Click "Log in to your account"
Fill in the login form
Submit
Check the 'form_serialized' cookie's value

=> Without this patch it contain login/password
=> With this patch applied the cookie is not created

Confirm that the "Return to the last advanced search" feature still
works as expected.

Signed-off-by: Nick Clemens <nick@bywatersolutions.com>
Comment 3 Marcel de Rooy 2022-01-27 14:27:36 UTC
(In reply to Nick Clemens from comment #2)

Great. Time for QA !
Comment 4 Marcel de Rooy 2022-01-27 14:44:39 UTC
Created attachment 129893 [details] [review]
Bug 29956: Prevent login form to be serialized into cookie

To recrate:
Logout
Go to /cgi-bin/koha/opac-search.pl
Click "Log in to your account"
Fill in the login form
Submit
Check the 'form_serialized' cookie's value

=> Without this patch it contain login/password
=> With this patch applied the cookie is not created

Confirm that the "Return to the last advanced search" feature still
works as expected.

Signed-off-by: Nick Clemens <nick@bywatersolutions.com>

Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl>
Comment 5 Martin Renvoize 2022-01-27 16:08:49 UTC
Yikes, that's scary..

Also confirmed the patch here works.. nice work team
Comment 6 wainuiwitikapark 2022-02-15 03:30:09 UTC
Backported to 19.11.x-security
Comment 7 Victor Grousset/tuxayo 2022-03-11 04:42:11 UTC
Backported: Pushed to 20.11.x-security branch for 20.11.16
Comment 8 Fridolin Somers 2022-03-16 08:10:18 UTC
Pushed to master for 22.05