Looks like an MD5 hash of a password field is being displayed in record holds grid
Bug #1729889 reported by
Cesar V
This bug affects 2 people
Affects | Status | Importance | Assigned to | Milestone | |
---|---|---|---|---|---|
Evergreen |
Fix Released
|
Undecided
|
Unassigned | ||
3.0 |
Won't Fix
|
Undecided
|
Unassigned | ||
3.1 |
Won't Fix
|
Undecided
|
Unassigned | ||
3.2 |
Fix Released
|
Undecided
|
Unassigned |
Bug Description
I've noticed that the Record Holds grid, has two password fields that are from the hold requestor and the user. See attached screenshot. The grid call that fetches the hold data seems to use cstore and thus the password fields are not suppressed. This is in latest EG and Opensurf (3.0+ for both).
Branch with potential patch to follow.
Changed in evergreen: | |
assignee: | nobody → Bill Erickson (berick) |
Changed in evergreen: | |
status: | New → Confirmed |
Changed in evergreen: | |
milestone: | 3.1.5 → 3.1.6 |
Changed in evergreen: | |
milestone: | 3.1.6 → 3.2.1 |
Changed in evergreen: | |
milestone: | 3.2.1 → 3.2.2 |
Changed in evergreen: | |
milestone: | 3.2.2 → 3.2.3 |
Changed in evergreen: | |
milestone: | 3.2.3 → 3.3-beta1 |
status: | Confirmed → New |
Changed in evergreen: | |
milestone: | 3.3-beta1 → 3.3-rc |
Changed in evergreen: | |
milestone: | 3.3-rc → 3.3.1 |
Changed in evergreen: | |
milestone: | 3.3.1 → 3.3.2 |
Changed in evergreen: | |
milestone: | 3.3.2 → 3.3.3 |
Changed in evergreen: | |
milestone: | 3.3.3 → 3.3.4 |
Changed in evergreen: | |
milestone: | 3.3.4 → 3.3.5 |
Changed in evergreen: | |
milestone: | 3.3.5 → 3.4.2 |
Changed in evergreen: | |
milestone: | 3.4.2 → 3.4.3 |
Changed in evergreen: | |
milestone: | 3.4.3 → 3.4.4 |
Changed in evergreen: | |
milestone: | 3.4.4 → 3.5.1 |
Changed in evergreen: | |
milestone: | 3.5.1 → 3.5.2 |
tags: | removed: webstaffblocker |
To post a comment you must log in.
Figured I'd just upload the patch, instead of pushing out a public branch. Just erring on the side caution...