0000761: Registration credentials stored in session allow user to re-register without entering username / password - PacketFence

Notes
(0001438) obilodeau (reporter) 2009-12-10 10:35	The session is not persistent so closing / re-opening the browser seems to remove stored credentials but its still pissing off Regis enough that he wrote a little patch: --- web.pm.old 2009-12-08 14:20:47.000000000 -0800 +++ web.pm 2009-12-08 14:22:20.000000000 -0800 @@ -484,9 +484,9 @@ my ( $cgi, $session ) = @_; my $logger = Log::Log4perl::get_logger('pf::web'); - if ( $session->param("login") ) { - return ( 1, 0 ); # if logged in, don't bother going further - } +# if ( $session->param("login") ) { +# return ( 1, 0 ); # if logged in, don't bother going further +# } if ( $cgi->param("login") && $cgi->param("password") && $cgi->param("auth") ) I'll now investigate if this was a real "feature" or if its just something that was done like that for no reason. If its the latter, then I'll apply the patch to mtn.

(0001439) obilodeau (reporter) 2009-12-10 11:21	Was introduced before monotone history. Read the code and aside from having to re-login when viewing status page or to deregister, I see no change from current behavior. Searched mailing list archive without any findings related to that behavior. I'll consider this a bug and fix it.

(0001440) obilodeau (reporter) 2009-12-10 11:38	fixed in 1.8 branch at montone rev: 7a8b920c5ac95d7b830c45af80832f0b358744e3 will be ported to 1.9 branch

(0001441) obilodeau (reporter) 2009-12-10 11:40	Reminder sent to: rbalzard Fix applied to prevent the annoying automatic re-registration.

Relationships