456955 - Password shown in plain text and saved plain in History

Status: RESOLVED DUPLICATE of bug 130327

(Firefox :: Bookmarks & History, defect)

Description

[u76985]

User-Agent:       Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.9.0.2) Gecko/2008091620 Firefox/3.0.2
Build Identifier: Firefox 3.0.0

please see http://www.fz-juelich.de/jsc/mail/Firefox_info/

Reproducible: Always

Steps to Reproduce:
1. go to https://imapsrv.fz-juelich.de/
2.
3.
Actual Results:  
pwd. shown in plain text; pwd saved (plain) in history, certificate not accepted

Expected Results:  
password should be encrypted; pwd. should not be saved in history; certificate should be accepted

could reproduce in 3.0.1, but not in 3.0.2 portable

Comment 1

[Lucas Adamski [:ladamski]]

The certificate authority (FZJ-PROJECTS-CA) that issued the certificate is not a recognized CA per the Firefox trusted CA store.  The same behavior is seen in other browsers, including Safari on Mac and IE7 on Windows.

Regarding the password, its not clear what you mean by saved; if it shows up in the URL itself it is because the email server itself is setting that via JavaScript, therefore it would be a bug in the server itself.  Sometimes servers store usernames and other sensitive things in the URL if cookies are restricted or disabled.

Comment 2

[Daniel Veditz [:dveditz]]

This does not need to be a hidden bug if people are making public postings about the problem. The cert thing is not part of this bug, that's expected at that site and the site has instructions for users on how to check the hash of the cert before accepting it (served on an HTTP page, of course). Not what we'd recommend, but definitely a side-issue.

There have been similar complaints about other web apps. Apparently if you don't sign into the correct server they redirect you, or maybe it's a single-signon kind of thing like the other bug I saw. In any case there is apparently some intermediate URL with the password in it. Firefox 3 is saving this into history, but other browsers--including Firefox 2--do not.

This really can't be verified or invalidated without signing up for an account on an affected site and trying it out.

Leaving unconfirmed because I haven't seen the problem myself, and there may be a dupe of this already given the public notice it's had.

Comment 3

[Boris Zbarsky [:bzbarsky]]

The "should I save it" decisions are in Places, code, right?

Comment 4

[Shawn Wilsher :sdwilsh]

(In reply to comment #3)
> The "should I save it" decisions are in Places, code, right?
yes

Comment 5

[Daniel Veditz [:dveditz]]

Lacking a clear duplicate I'm confirming this one.

Comment 6

[:Gavin Sharp [email: [e-mail]]]

dupe of bug 130327?

Comment 7

[Boris Zbarsky [:bzbarsky]]

Looks like it.

Comment 8

[Gervase Markham [:gerv]]

Bug 451915 - move Firefox/Places bugs to Firefox/Bookmarks and History. Remove all bugspam from this move by filtering for the string "places-to-b-and-h".

In Thunderbird 3.0b, you do that as follows:
Tools | Message Filters
Make sure the correct account is selected. Click "New"
Conditions: Body   contains   places-to-b-and-h
Change the action to "Delete Message".
Select "Manually Run" from the dropdown at the top.
Click OK.

Select the filter in the list, make sure "Inbox" is selected at the bottom, and click "Run Now". This should delete all the bugspam. You can then delete the filter.

Gerv