This is a snapshot of Indico's old Trac site. Any information contained herein is most probably outdated. Access our new GitHub site here.

Opened 23 months ago

#1439 new defect

Sanitization and password

Reported by: jbenito Owned by:
Priority: blocker Milestone: v2.1
Component: Security Version: 1.1
Keywords: Cc:

Description

Several issues:

  1. In base.py sanitization is happening after checkParams. So, if the developer gets the value into a variable in checkParams and uses it afterwards, sanitization would be useless (for case in which SanitizationLevel?=0)
  2. There is a variable in RH which is _doNotSanitizeFields that we can use to avoid some params (password) to be sanitize. Services does not implement it! it should be consistent.
  3. Once we move all the services to rest, make sure that we do not sanitize "accessKey" and "modifyKey"

Change History (0)

Note: See TracTickets for help on using tickets.