Bug #24456
closedInformation disclosure during backend login
100%
Description
In case a wrong username is submitted other HTTP headers are sent, than
in case only the password is wrong. This provides an attacker more
information than intended.
I tracked down this problem to the various session_start() calls, which
also send HTTP headers by default. If the submitted username exists, a
php session is started to get the challange out of the session
(compareUident()). This sends out some HTTP headers which will then
partly be overridden by header() calls (sendNoCacheHeaders()) with the
same HTTP headers (both happening in t3lib_userauth).
OTRS: 2011010210000017
Reporter: Sebastian Schinzel
(issue imported from #M16894)
Files
Updated by Oliver Hader over 13 years ago
- File 24456_42.patch 24456_42.patch added
Updated by Oliver Hader over 13 years ago
- Status changed from New to Under Review
Updated by Helmut Hummel about 13 years ago
- File 24456_v2.diff 24456_v2.diff added
This patch fixes the issue and makes login possible with phpmyadmin enabled
Updated by Oliver Hader about 13 years ago
- File 24456_43.patch 24456_43.patch added
- File 24456_44.patch 24456_44.patch added
- File 24456_45.patch 24456_45.patch added
- File 24456_46.patch 24456_46.patch added
Updated by Anonymous about 13 years ago
- Status changed from Under Review to Resolved
- % Done changed from 0 to 100
Applied in changeset e783aa69a7f48d971e87094fe825219cbd67f08c.
Updated by Helmut Hummel almost 13 years ago
- Project changed from 1716 to TYPO3 Core
Updated by Riccardo De Contardi almost 7 years ago
- Status changed from Resolved to Closed