oqapi/webgui
2
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

Prevent SSO fixation attacks against WebGUI by modifying Operation/SSO to log the user in as the user with a different session, and to require a flag in the config file to enable it. This feature will be removed in WebGUI 8. Fixes bug #12004.

Browse source
This commit is contained in:
Colin Kuskie 2011-01-10 14:07:59 -08:00
parent c65fd1946a
commit 6f34c25e82
4 changed files with 20 additions and 3 deletions
Download patch file Download diff file Expand all files Collapse all files

1
docs/changelog/7.x.x.txt
View file

@ -27,6 +27,7 @@
- fixed #11976: Use Container URL in search gives user Permission Denied
- fixed #11985: Search.pl should warn on bad assets
- fixed #12008: Activity CleanLoginHistory is too slow
- fixed #12004: SSO operation vulnerable to session fixation attacks
7.10.6
- fixed #11974: Toolbar icons unclickable in Webkit using HTML5