You are viewing a plain text version of this content. The canonical link for it is here.
Posted to jetspeed-dev@portals.apache.org by "radko keves (JIRA)" <je...@portals.apache.org> on 2009/10/22 13:51:59 UTC
[jira] Created: (JS2-1076) insecure redirector during login
insecure redirector during login
--------------------------------
Key: JS2-1076
URL: https://issues.apache.org/jira/browse/JS2-1076
Project: Jetspeed 2
Issue Type: Bug
Components: Security
Environment: all
Reporter: radko keves
/jetspeed/login/redirector?token
token.getToken() added to redirector isn't encoded
--
This message is automatically generated by JIRA.
-
You can reply to this email to add a comment to the issue online.
---------------------------------------------------------------------
To unsubscribe, e-mail: jetspeed-dev-unsubscribe@portals.apache.org
For additional commands, e-mail: jetspeed-dev-help@portals.apache.org
[jira] Assigned: (JS2-1076) insecure redirector during login
Posted by "Ate Douma (JIRA)" <je...@portals.apache.org>.
[ https://issues.apache.org/jira/browse/JS2-1076?page=com.atlassian.jira.plugin.system.issuetabpanels:all-tabpanel ]
Ate Douma reassigned JS2-1076:
------------------------------
Assignee: Ate Douma
> insecure redirector during login
> --------------------------------
>
> Key: JS2-1076
> URL: https://issues.apache.org/jira/browse/JS2-1076
> Project: Jetspeed 2
> Issue Type: Bug
> Components: Security
> Environment: all
> Reporter: radko keves
> Assignee: Ate Douma
> Fix For: 2.1.4, 2.2.1
>
>
> /jetspeed/login/redirector?token
> token.getToken() added to redirector isn't encoded
--
This message is automatically generated by JIRA.
-
You can reply to this email to add a comment to the issue online.
---------------------------------------------------------------------
To unsubscribe, e-mail: jetspeed-dev-unsubscribe@portals.apache.org
For additional commands, e-mail: jetspeed-dev-help@portals.apache.org
[jira] Updated: (JS2-1076) insecure redirector during login
Posted by "Ate Douma (JIRA)" <je...@portals.apache.org>.
[ https://issues.apache.org/jira/browse/JS2-1076?page=com.atlassian.jira.plugin.system.issuetabpanels:all-tabpanel ]
Ate Douma updated JS2-1076:
---------------------------
Affects Version/s: (was: 2.1.4)
Fix Version/s: 2.1.4
> insecure redirector during login
> --------------------------------
>
> Key: JS2-1076
> URL: https://issues.apache.org/jira/browse/JS2-1076
> Project: Jetspeed 2
> Issue Type: Bug
> Components: Security
> Environment: all
> Reporter: radko keves
> Fix For: 2.1.4, 2.2.1
>
>
> /jetspeed/login/redirector?token
> token.getToken() added to redirector isn't encoded
--
This message is automatically generated by JIRA.
-
You can reply to this email to add a comment to the issue online.
---------------------------------------------------------------------
To unsubscribe, e-mail: jetspeed-dev-unsubscribe@portals.apache.org
For additional commands, e-mail: jetspeed-dev-help@portals.apache.org
[jira] Resolved: (JS2-1076) insecure redirector during login
Posted by "Ate Douma (JIRA)" <je...@portals.apache.org>.
[ https://issues.apache.org/jira/browse/JS2-1076?page=com.atlassian.jira.plugin.system.issuetabpanels:all-tabpanel ]
Ate Douma resolved JS2-1076.
----------------------------
Resolution: Fixed
Fixed by escaping input values within LoginProxyServlet.
Thanks for the report Radko!
> insecure redirector during login
> --------------------------------
>
> Key: JS2-1076
> URL: https://issues.apache.org/jira/browse/JS2-1076
> Project: Jetspeed 2
> Issue Type: Bug
> Components: Security
> Environment: all
> Reporter: radko keves
> Assignee: Ate Douma
> Fix For: 2.1.4, 2.2.1
>
>
> /jetspeed/login/redirector?token
> token.getToken() added to redirector isn't encoded
--
This message is automatically generated by JIRA.
-
You can reply to this email to add a comment to the issue online.
---------------------------------------------------------------------
To unsubscribe, e-mail: jetspeed-dev-unsubscribe@portals.apache.org
For additional commands, e-mail: jetspeed-dev-help@portals.apache.org
[jira] Updated: (JS2-1076) insecure redirector during login
Posted by "Ate Douma (JIRA)" <je...@portals.apache.org>.
[ https://issues.apache.org/jira/browse/JS2-1076?page=com.atlassian.jira.plugin.system.issuetabpanels:all-tabpanel ]
Ate Douma updated JS2-1076:
---------------------------
Affects Version/s: 2.1.4
Fix Version/s: 2.2.1
See also JS2-1075, part of the generated token key is based upon username, which should be encoded first
> insecure redirector during login
> --------------------------------
>
> Key: JS2-1076
> URL: https://issues.apache.org/jira/browse/JS2-1076
> Project: Jetspeed 2
> Issue Type: Bug
> Components: Security
> Environment: all
> Reporter: radko keves
> Fix For: 2.1.4, 2.2.1
>
>
> /jetspeed/login/redirector?token
> token.getToken() added to redirector isn't encoded
--
This message is automatically generated by JIRA.
-
You can reply to this email to add a comment to the issue online.
---------------------------------------------------------------------
To unsubscribe, e-mail: jetspeed-dev-unsubscribe@portals.apache.org
For additional commands, e-mail: jetspeed-dev-help@portals.apache.org