[Rt-devel] *possible* RT security bug
chad at opensourcery.com
Thu Apr 16 12:39:19 EDT 2009
Noticed when writing a plugin. I have debugging that prints out the
content of %ARGS. I went to the page while not logged in, it prompted
for login. Logged in and it redirected to the page I am working on. the
debugging showed the username and password in %ARGS.
I would expect the username and password to be stripped from %ARGS the
moment the login validation stage is complete (on success or failure). I
do not have any clear ideas on how to exploit this, but it seems pretty
-------------- next part --------------
A non-text attachment was scrubbed...
Size: 252 bytes
Desc: OpenPGP digital signature
Url : http://lists.bestpractical.com/pipermail/rt-devel/attachments/20090416/ddfffecb/attachment.pgp
More information about the Rt-devel