summaryrefslogtreecommitdiffstats
path: root/Bugzilla/Auth
diff options
context:
space:
mode:
authormkanat%kerio.com <>2005-05-12 10:52:13 +0200
committermkanat%kerio.com <>2005-05-12 10:52:13 +0200
commit8f2bc1b07ce4150a878e80f5bce09e819cbfd414 (patch)
tree20f43dfce988ecfa01d14bbc4b9139ecc79f35cd /Bugzilla/Auth
parente21b1306af07a0065ef4f8ab9d3b657a03a463be (diff)
downloadbugzilla-8f2bc1b07ce4150a878e80f5bce09e819cbfd414.tar.gz
bugzilla-8f2bc1b07ce4150a878e80f5bce09e819cbfd414.tar.xz
Bug 287436: [SECURITY] After having logged in, links to change the report type contain username and password
Patch By Marc Schumann <wurblzap@gmail.com> r=gerv, a=justdave
Diffstat (limited to 'Bugzilla/Auth')
-rw-r--r--Bugzilla/Auth/Login/WWW/CGI.pm2
1 files changed, 2 insertions, 0 deletions
diff --git a/Bugzilla/Auth/Login/WWW/CGI.pm b/Bugzilla/Auth/Login/WWW/CGI.pm
index d99cd3b80..98fd3a6d3 100644
--- a/Bugzilla/Auth/Login/WWW/CGI.pm
+++ b/Bugzilla/Auth/Login/WWW/CGI.pm
@@ -50,6 +50,8 @@ sub login {
# First, try the actual login method against form variables
my $username = $cgi->param("Bugzilla_login");
my $passwd = $cgi->param("Bugzilla_password");
+
+ $cgi->delete('Bugzilla_login', 'Bugzilla_password');
my $authmethod = Param("user_verify_class");
my ($authres, $userid, $extra, $info) =