646988 - MindTouch 2010 sends user password in cleartext

Status: RESOLVED FIXED

Description

[raymond [:retornam] (inactive)]

1) Register a new account on https://developer-stage.mozilla.org/En
2) Check your email to find your password in cleartext

Comment 1

[Luke Crouch [:groovecoder]]

mcoates: what's the preferred fix for this? password reset link? is it okay if it's a one-time password?

Comment 2

[Jay Patel [:jay]]

we fixed this on v9 already...  bug 620395.  is this another case of mindtouch not patching their latest version?

Comment 3

[Luke Crouch [:groovecoder]]

cc me on the bug so I can tell if it's the same xss

Comment 4

[Luke Crouch [:groovecoder]]

looks like we need to copy over the same resources files into mindtouch 10

Comment 5

[Michael Coates [:mcoates] (acct no longer active)]

(In reply to comment #1)
> mcoates: what's the preferred fix for this? password reset link? is it okay if
> it's a one-time password?

- Send the user a random token within a reset link.
- If not used, the token automatically expires after 4 hrs.
- The reset link forces an immediate password change.  

If this is a django app there is built in functionality to support this.

Comment 6

[Luke Crouch [:groovecoder]]

No, this is MindTouch ... again. :(

Comment 7

[Eric Shepherd [:sheppy]]

This... is a long-standing issue. I'm not sure if it makes sense to block the MindTouch 2010 upgrade for it, given it exists in every version we've used to date.

Comment 8

[Michael Coates [:mcoates] (acct no longer active)]

(In reply to comment #7)
> This... is a long-standing issue. I'm not sure if it makes sense to block the
> MindTouch 2010 upgrade for it, given it exists in every version we've used to
> date.

We don't have to block the upgrade, but we will need to patch it ourselves as we did in bug 620395.

Comment 9

[Michael Coates [:mcoates] (acct no longer active)]

What is our plan here? Is this issue still present? Can we upgrade and do our own patch?

Comment 10

[Luke Crouch [:groovecoder]]

I re-opened bug 620395 to re-apply the patch to stage9 and production.

Comment 11

[John Karahalis [:openjck]]

This is not a problem in Kuma, the new MDN platform that replaced Mindtouch. Marking as fixed!

Comment 12

[Les Orchard [:lorchard]]

Fixed by complete replacement of MindTouch. And also, we don't use passwords any more since adopting BrowserID