289965 - Password visible in Query string

Status: VERIFIED DUPLICATE of bug 287436

(Bugzilla :: User Accounts, defect)

Description

[Rajesh]

User-Agent:       Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.7.6) Gecko/20050317 Firefox/1.0.2
Build Identifier: Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.7.6) Gecko/20050317 Firefox/1.0.2

1. Login to Bugzilla
2. Create a tabular report
3. Copy the url for any of the resulting numbers (ex: buglist url for total
number of bugs)
4. Log out
5. Paste the url in your browser
6. Put in the username and password and login
7. In the buglist page click on change columns hyper link.

Now Password is visible in the URL.

This is not reproducible in BMO since all the assets are available for everyone
to query without logging into the application. 

Please try it where it is required for every one to login to system before they
query/add/edit bugs.

Reproducible: Always

Comment 1

[Dave Miller [:justdave]]

*** This bug has been marked as a duplicate of 287436 ***

Comment 2

[Dave Miller [:justdave]]

The bug this is duplicate of is no longer secured, so unsecuring this one.