You are viewing a plain text version of this content. The canonical link for it is here.
Posted to dev@lenya.apache.org by bu...@apache.org on 2006/01/25 17:00:01 UTC
DO NOT REPLY [Bug 38383] New: - Login page should use POST method instead of GET
DO NOT REPLY TO THIS EMAIL, BUT PLEASE POST YOUR BUG�
RELATED COMMENTS THROUGH THE WEB INTERFACE AVAILABLE AT
<http://issues.apache.org/bugzilla/show_bug.cgi?id=38383>.
ANY REPLY MADE TO THIS MESSAGE WILL NOT BE COLLECTED AND�
INSERTED IN THE BUG DATABASE.
http://issues.apache.org/bugzilla/show_bug.cgi?id=38383
Summary: Login page should use POST method instead of GET
Product: Lenya
Version: 1.2.4
Platform: All
OS/Version: All
Status: NEW
Severity: critical
Priority: P1
Component: Access Control
AssignedTo: dev@lenya.apache.org
ReportedBy: bobharner@gmail.com
The login page for Lenya 1.2.4 (and I think 1.4 as well) uses a GET
instead of a POST, which causes user passwords to be exposed in clear text in
the web access log files.
The solution is to change login.xsl from this:
<form method="get">
<input type="hidden" name="lenya.usecase" value="login" />
<input type="hidden" name="lenya.step" value="login" />
to this:
<form method="post" action="?lenya.usecase=login&lenya.step=login">
I'll attach a patch shortly...
--
Configure bugmail: http://issues.apache.org/bugzilla/userprefs.cgi?tab=email
------- You are receiving this mail because: -------
You are the assignee for the bug, or are watching the assignee.
---------------------------------------------------------------------
To unsubscribe, e-mail: dev-unsubscribe@lenya.apache.org
For additional commands, e-mail: dev-help@lenya.apache.org
DO NOT REPLY [Bug 38383] - Login page should use POST method instead of GET
Posted by bu...@apache.org.
DO NOT REPLY TO THIS EMAIL, BUT PLEASE POST YOUR BUG�
RELATED COMMENTS THROUGH THE WEB INTERFACE AVAILABLE AT
<http://issues.apache.org/bugzilla/show_bug.cgi?id=38383>.
ANY REPLY MADE TO THIS MESSAGE WILL NOT BE COLLECTED AND�
INSERTED IN THE BUG DATABASE.
http://issues.apache.org/bugzilla/show_bug.cgi?id=38383
michi@apache.org changed:
What |Removed |Added
----------------------------------------------------------------------------
Status|NEW |RESOLVED
Resolution| |FIXED
------- Additional Comments From michi@apache.org 2006-01-26 09:37 -------
applied. Thanks a lot Michi
--
Configure bugmail: http://issues.apache.org/bugzilla/userprefs.cgi?tab=email
------- You are receiving this mail because: -------
You are the assignee for the bug, or are watching the assignee.
---------------------------------------------------------------------
To unsubscribe, e-mail: dev-unsubscribe@lenya.apache.org
For additional commands, e-mail: dev-help@lenya.apache.org
DO NOT REPLY [Bug 38383] - Login page should use POST method instead of GET
Posted by bu...@apache.org.
DO NOT REPLY TO THIS EMAIL, BUT PLEASE POST YOUR BUG�
RELATED COMMENTS THROUGH THE WEB INTERFACE AVAILABLE AT
<http://issues.apache.org/bugzilla/show_bug.cgi?id=38383>.
ANY REPLY MADE TO THIS MESSAGE WILL NOT BE COLLECTED AND�
INSERTED IN THE BUG DATABASE.
http://issues.apache.org/bugzilla/show_bug.cgi?id=38383
------- Additional Comments From bobharner@gmail.com 2006-01-25 17:07 -------
Created an attachment (id=17502)
--> (http://issues.apache.org/bugzilla/attachment.cgi?id=17502&action=view)
Patch against Lenya 1.2.x to fix bug 38383
This patch is tested against Lenya 1.2.4 1.2.x.
It might work against 1.4 as well (but not tested)
--
Configure bugmail: http://issues.apache.org/bugzilla/userprefs.cgi?tab=email
------- You are receiving this mail because: -------
You are the assignee for the bug, or are watching the assignee.
---------------------------------------------------------------------
To unsubscribe, e-mail: dev-unsubscribe@lenya.apache.org
For additional commands, e-mail: dev-help@lenya.apache.org
DO NOT REPLY [Bug 38383] - Login page should use POST method instead of GET
Posted by bu...@apache.org.
DO NOT REPLY TO THIS EMAIL, BUT PLEASE POST YOUR BUG�
RELATED COMMENTS THROUGH THE WEB INTERFACE AVAILABLE AT
<http://issues.apache.org/bugzilla/show_bug.cgi?id=38383>.
ANY REPLY MADE TO THIS MESSAGE WILL NOT BE COLLECTED AND�
INSERTED IN THE BUG DATABASE.
http://issues.apache.org/bugzilla/show_bug.cgi?id=38383
------- Additional Comments From bobharner@gmail.com 2006-01-25 17:10 -------
(From update of attachment 17502)
>Index: C:/Documents and Settings/bharner/workspace/lenya-1.2.x/src/webapp/lenya/xslt/ac/login.xsl
>===================================================================
>--- C:/src/lenya-1.2.x/src/webapp/lenya/xslt/ac/login.xsl (revision 371289)
>+++ C:/src/lenya-1.2.x/src/webapp/lenya/xslt/ac/login.xsl (working copy)
>@@ -73,9 +73,7 @@
> <i18n:text>Login</i18n:text>
> </div>
> <div class="lenya-box-body">
>- <form method="get">
>- <input type="hidden" name="lenya.usecase" value="login" />
>- <input type="hidden" name="lenya.step" value="login" />
>+ <form method="post" action="?lenya.usecase=login&lenya.step=login">
> <table class="lenya-table-noborder">
> <tr>
> <td>
--
Configure bugmail: http://issues.apache.org/bugzilla/userprefs.cgi?tab=email
------- You are receiving this mail because: -------
You are the assignee for the bug, or are watching the assignee.
---------------------------------------------------------------------
To unsubscribe, e-mail: dev-unsubscribe@lenya.apache.org
For additional commands, e-mail: dev-help@lenya.apache.org