287436 - After having logged in, links to change the report type contain username and password

Status: RESOLVED FIXED

(Bugzilla :: User Accounts, defect, P1)

Description

[Roman Pszonka]

User-Agent:       Mozilla/5.0 (Windows; U; Windows NT 5.0; pl-PL; rv:1.7.5) Gecko/20041108 Firefox/1.0
Build Identifier: Mozilla/5.0 (Windows; U; Windows NT 5.0; pl-PL; rv:1.7.5) Gecko/20041108 Firefox/1.0

This bug occurred on my bugzilla installation, using Firefox which needs to
re-log in to almost every time I go to different page, but you can also use the
following repro steps.

Reproducible: Always

Steps to Reproduce:
1. go to https://bugzilla.mozilla.org/query.cgi?format=report-table and choose
some fields to gather data for report
2. if you are logged in, log out (e.g. on another tab)
3. click 'Generate Report'
4. login as requested
5. choose link for different report type (like 'Bar', 'Line', or 'CSV')

Actual Results:  
Username and password is visible in links.

Expected Results:  
Don't show username and password.

Comment 1

[Dave Miller [:justdave]]

This was independently confirmed by Wurblzap on irc.

Comment 2

[Marc Schumann [:Wurblzap]]

Attachment: Head patch

This patch removes Bugzilla_login and Bugzilla_password as soon as possible
from the CGI params.

The special case in chart.cgi is not needed anymore and goes away.

userprefs.cgi is a special case because it needs access to these variables, so
the params are saved in time.

Comment 3

[Gervase Markham [:gerv]]

Comment on attachment 178463 [details] [diff] [review]
Head patch

Looks good - very sensible fix. r=gerv.

Gerv

Comment 4

[Dave Miller [:justdave]]

holding approvals for release day

Comment 5

[Marc Schumann [:Wurblzap]]

Attachment: Branch patch

Simple backport.

Comment 6

[Dave Miller [:justdave]]

*** Bug 289965 has been marked as a duplicate of this bug. ***

Comment 7

[Max Kanat-Alexander]

*** Bug 291824 has been marked as a duplicate of this bug. ***

Comment 8

[Dave Miller [:justdave]]

ok, release is imminent, let's roll :)

Comment 9

[Max Kanat-Alexander]

Tip:

Checking in chart.cgi;
/cvsroot/mozilla/webtools/bugzilla/chart.cgi,v  <--  chart.cgi
new revision: 1.11; previous revision: 1.10
done
Checking in userprefs.cgi;
/cvsroot/mozilla/webtools/bugzilla/userprefs.cgi,v  <--  userprefs.cgi
new revision: 1.75; previous revision: 1.74
done
Checking in Bugzilla/Auth/Login/WWW/CGI.pm;
/cvsroot/mozilla/webtools/bugzilla/Bugzilla/Auth/Login/WWW/CGI.pm,v  <--  CGI.pm
new revision: 1.10; previous revision: 1.9
done

2.18:

Checking in chart.cgi;
/cvsroot/mozilla/webtools/bugzilla/chart.cgi,v  <--  chart.cgi
new revision: 1.7.2.2; previous revision: 1.7.2.1
done
Checking in userprefs.cgi;
/cvsroot/mozilla/webtools/bugzilla/userprefs.cgi,v  <--  userprefs.cgi
new revision: 1.58.2.5; previous revision: 1.58.2.4
done
Checking in Bugzilla/Auth/CGI.pm;
/cvsroot/mozilla/webtools/bugzilla/Bugzilla/Auth/Attic/CGI.pm,v  <--  CGI.pm
new revision: 1.7.2.2; previous revision: 1.7.2.1
done