User password should not be displayed/sent

[Xavier ALT]

Hi,

The user password is shown in cleartext in the Preference page source, this allow an attaquant to steal the password from the user.

Steps to reproduce:
1. Log in the web client
2. Go the Preferences (top-right button)
3. Show the page source, search for id="password" ... the <input/> element contain the value="PASSWORD".

The password should always be anonymized between the user and the web client.
A better approch could be:
  Always send ********, because if the user want to change his password he need to re-type it entirely anyway. So if the web client received anything other than ******** then, and only then it should write the password to the server!.

(NB: This bug was reported by an external Security Consultant during an OpenERP security audit of one of our customer)

[Xavier ALT (dex-phx)]

Hi guys,

Here I propose a patch.

For every read the password is now overwritten by '********'. And the password is only written to the database if it's different from '********'.

[Amit Mendapara (cristatus)]

This is related to server as web client just renders the views provided by server. One possible solution is to, introduce two function fields in res.users to allow change of password. The original password field should read '******' as suggested in the given patch and the two function fields should be used to provide new password if given the current password from the original password field.

[Yogesh (SerpentCS) (yogesh-serpentcs)]

Hello,

It has been fixed into https://code.launchpad.net/~openerp-dev/openobject-server/ysa-server-framework branch by:
Revision ID: <email address hidden>
Revno: 3040

Thanks.