New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Reset password form exposing old and new passwords in clear text (via GET params) #382

Open

brylie opened this issue Sep 4, 2015 · 1 comment

brylie commented Sep 4, 2015

When submitting the Change Password form, the old password, new password, and password confirmation are displayed in the URL as plain text.

This may be fixed by submitting the form by POST rather than GET.

brylie mentioned this issue

Change password form exposes password text in URL as plain text apinf/platform#436

Closed

Author

brylie commented Sep 30, 2015

It may simply be an issue of the form not having a method=POST attribute.

Changing resetPassword.html line 14 to include method="POST" may resolve this issue.

<form id="resetPassword" method="POST">

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment