[TikiWiki-commits] [Git][tikiwiki/tiki][27.x] [BP][FIX] Password exposed over GET

Elifeleti Mukisa Dan pushed to branch 27.x at Tiki Wiki CMS Groupware / Tiki


Commits:
a8533da8 by Elifeleti Mukisa Dan at 2026-05-22T23:38:20+00:00
[BP][FIX] Password exposed over GET
---
* [BP][FIX] Password exposed over GET
---
* [BP][FIX] Password exposed over GET
---
* [FIX] Password exposed over GET
---
* [FIX] Password exposed over GET


(cherry picked from commit 6801bc868cee7399132d222b79ba35e68dd1bd21)

6801bc86 [FIX] Password exposed over GET

Co-authored-by: Danelif <[email protected]>

See merge request tikiwiki/tiki!10305


(cherry picked from commit be39d8e3b14fee7ae39037473451cf452af2ab42)

d89f9a50 [FIX] Password exposed over GET

Co-authored-by: Elifeleti Mukisa Dan <[email protected]>

See merge request tikiwiki/tiki!10321

See merge request tikiwiki/tiki!10331

See merge request tikiwiki/tiki!10345

- - - - -


1 changed file:

- templates/tiki-adminusers.tpl


Changes:

=====================================
templates/tiki-adminusers.tpl
=====================================
@@ -432,9 +432,16 @@
                     {button href="tiki-assignuser.php?assign_user=$thisloginescaped" _text="{tr}Assign user to Groups{/tr}" _icon_name='group'}
                 {/if}
                 {if $userinfo.waiting eq 'a'}
-                    {$thispassescaped = $userinfo.valid|escape:'url'}
+                    {$thispassescaped = $userinfo.valid|escape:'attr'}
                     {if empty($thispassescaped)}{$thispassescaped = 0}{/if}
-                    {button href='tiki-login_validate.php?user='|cat:$thisloginescaped|cat:'&pass='|cat:$thispassescaped _text="{tr}Validate user{/tr}" _icon_name='ok'}
+                    <form action="tiki-login_validate.php" method="post" class="d-inline">
+                        {ticket}
+                        <input type="hidden" name="user" value="{$userinfo.login|escape:'attr'}">
+                        <input type="hidden" name="pass" value="{$thispassescaped}">
+                        <button type="submit" class="btn btn-link">
+                            {icon name="ok"} {tr}Validate user{/tr}
+                        </button>
+                    </form>
                 {/if}
             {else}
                 <h2>{tr}Add a New User{/tr}</h2>



View it on GitLab: https://gitlab.com/tikiwiki/tiki/-/commit/a8533da8b3623a63faa8b36d9fca6f4edd094d8e

-- 
View it on GitLab: https://gitlab.com/tikiwiki/tiki/-/commit/a8533da8b3623a63faa8b36d9fca6f4edd094d8e
You're receiving this email because of your account on gitlab.com. Manage all notifications: https://gitlab.com/-/profile/notifications | Help: https://gitlab.com/help

_______________________________________________
TikiWiki-cvs mailing list
[email protected]
https://lists.sourceforge.net/lists/listinfo/tikiwiki-cvs