oqapi/webgui
2
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

Prevent SSO fixation attacks against WebGUI by modifying Operation/SSO to log the user in as the user with a different session, and to require a flag in the config file to enable it. This feature will be removed in WebGUI 8. Fixes bug #12004.

Browse source
This commit is contained in:
Colin Kuskie 2011-01-10 14:07:59 -08:00
parent c65fd1946a
commit 6f34c25e82
4 changed files with 20 additions and 3 deletions
Download patch file Download diff file Expand all files Collapse all files

5
etc/WebGUI.conf.original
View file

@ -1097,6 +1097,9 @@
# An array of SPAM words. Used in the Post and WikiPage to block spam by sending the asset directly
# to the trash.
"spamStopWords" : [
]
],
# A flag to enable a very simple SSO mechanism using sessionIds.
"enableSimpleSSO" : 0
}