Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

When you delete a user, cookie data is not automatically removed #4575

Closed
TheWitness opened this issue Feb 27, 2022 · 0 comments
Closed

When you delete a user, cookie data is not automatically removed #4575

TheWitness opened this issue Feb 27, 2022 · 0 comments
Labels
bug Undesired behaviour
Milestone
v1.2.20

Comments

@TheWitness
Copy link
Member

Describe the bug

When you remove a user, if that user has been using the 'remember me' functionality, their session data in user_auth_cache is not removed. This session data will be removed within 90 days, but you should remove the data immediately if possible.

Expected behavior

Less Cacti bugs.
@TheWitness TheWitness added bug Undesired behaviour unverified Some days we don't have a clue labels Feb 27, 2022
@TheWitness TheWitness added this to the v1.2.20 milestone Feb 27, 2022
@TheWitness TheWitness removed the unverified Some days we don't have a clue label Feb 27, 2022
TheWitness added a commit that referenced this issue Feb 27, 2022
@TheWitness
Fixing Multiple Bugs and one Feature #4576, #4579, #4573, #4575, #4577,
5d1b8e6 
#4578, #4574

-security#4576: Stored XSS Issue in Cacti Device, Graph, Graph Template, and Graph Items callbacks
-security#4579: Cacti account lockout policies are not properly applied to LDAP and Domain Users
-issue#4573: The Cacti permission system does not scale to very large installations
-issue#4575: When you delete a user, their 'remember me' cookie data is not automatically removed
-issue#4576: Stored XSS Issue in Cacti Device, Graph, Graph Template, and Graph Items callbacks
-issue#4577: Cacti allows you to disable the currently logged in administrator disabling the user
-issue#4578: The Cacti login algorithm is complicated to understand due to too much strait line code
-feature#4574: Cacti needs some additional permission methods for larger installations

This change properly documents the file lib/auth.php using phpDocument format, and performed multiple sanity and readability changes such as the renaming of variables commonly used in multiple functions.

The the restructuring of the three authentication files:

- auth_login.php
- include/auth.php
- lib/auth.php

Makes the code more readable, it's not a complete solution, however, it is much easier to follow now.
@netniV netniV changed the title When you delete a user, their 'remember me' cookie data is not automatically removed When you delete a user, cookie data is not automatically removed Apr 3, 2022
@github-actions github-actions bot locked and limited conversation to collaborators Dec 2, 2022
Sign up for free to subscribe to this conversation on GitHub. Already have an account? Sign in.
Assignees
No one assigned
Labels
bug Undesired behaviour
Projects
None yet
Milestone
v1.2.20
Development

No branches or pull requests
1 participant
@TheWitness