Yes, not a joke.
Created attachment 129876 [details] [review] Bug 29956: Prevent login form to be serialized into cookie To recrate: Logout Go to /cgi-bin/koha/opac-search.pl Click "Log in to your account" Fill in the login form Submit Check the 'form_serialized' cookie's value => Without this patch it contain login/password => With this patch applied the cookie is not created Confirm that the "Return to the last advanced search" feature still works as expected.
Created attachment 129881 [details] [review] Bug 29956: Prevent login form to be serialized into cookie To recrate: Logout Go to /cgi-bin/koha/opac-search.pl Click "Log in to your account" Fill in the login form Submit Check the 'form_serialized' cookie's value => Without this patch it contain login/password => With this patch applied the cookie is not created Confirm that the "Return to the last advanced search" feature still works as expected. Signed-off-by: Nick Clemens <nick@bywatersolutions.com>
(In reply to Nick Clemens from comment #2) Great. Time for QA !
Created attachment 129893 [details] [review] Bug 29956: Prevent login form to be serialized into cookie To recrate: Logout Go to /cgi-bin/koha/opac-search.pl Click "Log in to your account" Fill in the login form Submit Check the 'form_serialized' cookie's value => Without this patch it contain login/password => With this patch applied the cookie is not created Confirm that the "Return to the last advanced search" feature still works as expected. Signed-off-by: Nick Clemens <nick@bywatersolutions.com> Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl>
Yikes, that's scary.. Also confirmed the patch here works.. nice work team
Backported to 19.11.x-security
Backported: Pushed to 20.11.x-security branch for 20.11.16
Pushed to master for 22.05