[Author Prev][Author Next][Thread Prev][Thread Next][Author Index][Thread Index]

[tor-bugs] #2521 [Tor Weather]: Weather shouldn't use the confirm_auth string in the URL of the /pending/ page

#2521: Weather shouldn't use the confirm_auth string in the URL of the /pending/
page
--------------------------+-------------------------------------------------
  Reporter:  kaner        |              Owner:  kaner
      Type:  defect       |             Status:  new  
  Priority:  normal       |          Milestone:       
 Component:  Tor Weather  |            Version:       
  Keywords:               |             Parent:       
    Points:               |   Actualpointsdone:       
Pointsdone:               |       Actualpoints:       
--------------------------+-------------------------------------------------
 Currently Weather forwards a newly subscribed user to the /pending/ page,
 passing on the confirm_auth string in the URL. This is a bad idea from a
 security point of view. Nicolas Pouillard reported this issue (thanks!).
 It is currently worked around in the live version of Weather.

 A real fix might need a redesign of some parts or workflows in Weather.

-- 
Ticket URL: <https://trac.torproject.org/projects/tor/ticket/2521>
Tor Bug Tracker & Wiki <https://trac.torproject.org/>
The Tor Project: anonymity online
_______________________________________________
tor-bugs mailing list
tor-bugs@xxxxxxxxxxxxxxxxxxxx
https://lists.torproject.org/cgi-bin/mailman/listinfo/tor-bugs