Frontend Users security issue?

For questions and problems with the CMS core. This board is NOT for any 3rd party modules, addons, PHP scripts or anything NOT distributed with the CMS made simple package itself.
Post Reply
jmcgin51
Power Poster
Power Poster
Posts: 1899
Joined: Mon Jun 12, 2006 9:02 pm

Frontend Users security issue?

Post by jmcgin51 »

As I was trying to figure out what is causing my FEU users not to expire and what is causing me to get an "Incorrect datetime value" error when I try to create an FEU user, I realized that the URL that is passed from page to page during the creation process contains the password that I entered for the user.  I'm not a programmer (which is why I love the simplicity of CMSMS), but it seems to me that this isn't good.  For example, here's a URL from the page where you enter the values for the selected properties for a user (the last step before the user is actually created):
http://mywebsite.com/cmsms/admin/module ... ast=mylast name&m1_hidden_cmsms_userid=cmsms_userid%3B0%3B5%3B2%3B5&m1_input_cmsms_userid=mycmsmsuserid&m1_hidden_email=email%3B2%3B40%3B2%3B40&m1_input_email=myemailaddress&m1_step1_params=input_username%3Dmyusername%26input_password%3Dmypassword%26input_repeatpassword%3Dmypassword%26expiresdate_Month%3D12%26expiresdate_Day%3D4%26expiresdate_Year%3D2007%26memberof_1%3D1%26submit%3DNext%26input_expiresdate%3D1196744400%26action%3Ddo_adduser2&m1_submit=Next&m1_input_username=myusername&m1_input_password=mypassword&m1_input_repeatpassword=mypassword&m1_expiresdate_Month=12&m1_expiresdate_Day=4&m1_expiresdate_Year=2007&m1_memberof_1=1&m1_input_expiresdate=1196744400&m1_error=1&m1_message=Incorrect%20datetime%20value%3A%20%27%272006-12-04%2021%3A38%3A55%27%27%20for%20column%20%27createdate%27%20at%20row%201
(I replaced the actual url, username, password, etc, with "mywebsite", "my password", etc)

Would like to hear comments from those who are smarter than I are ;-)
jmcgin51
Power Poster
Power Poster
Posts: 1899
Joined: Mon Jun 12, 2006 9:02 pm

Re: Frontend Users security issue? (PARTLY resolved)

Post by jmcgin51 »

I no longer have problems with users not expiring, but my question about security still remains.  Can anyone address this?  It doesn't seem very secure to have the user information passed in the URL, where it can be read by anyone who wants to read it.
Post Reply

Return to “CMSMS Core”