mirror of
https://github.com/BookStackApp/BookStack.git
synced 2026-02-08 19:06:06 +03:00
Insecure password in POST request #2793
Reference in New Issue
Block a user
Delete Branch "%!s()"
Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?
Originally created by @KarelWintersky on GitHub (May 13, 2022).
Describe the Bug
Steps to Reproduce
Goto: https://demo.bookstackapp.com/login
Enter login & password
Click "Вход"
Expected Behaviour
Hashed or crypted password
Screenshots or Additional Context
No response
Browser Details
Any
Exact BookStack Version
22.04.2 (may be)
PHP Version
No response
Hosting Environment
Demo
@ssddanbrown commented on GitHub (May 13, 2022):
@KarelWintersky You may also need to report this one to google, since their login does the same.
Passwords are hashed in storage in BookStack. Hashing/encrypting client side doesn't really add much security, just adds complexity. Sure, it may slightly help in non-HTTPS cases, but it still won't protect access to the BookStack account and those cases are already open to a wider array of security concerns.
@KarelWintersky commented on GitHub (May 13, 2022):
appealing to the errors of a third-party resource cannot be an excuse
@ssddanbrown commented on GitHub (May 13, 2022):
@KarelWintersky Sure, It was a joke though, hence why I justified our existing methods in my comment above.
Happy to hear why we're insecure though if you believe this to be a legitimate vulnerability.