Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

fix(security): remove password update notification feature for security #8251

Closed

Conversation

vjFaLk
Copy link
Contributor

@vjFaLk vjFaLk commented Aug 23, 2019

This "feature" sends the User's password in plain-text via Email. The password ends up in the Email Queue, also in plain-text.

Copy link
Member

@rmehta rmehta left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

This is a user triggered action. Even GSuite does the same thing.

Better way would be to add a feature in email queue for "Clear content after send" and then delete the content after the email is flushed.

@stale
Copy link

stale bot commented Sep 8, 2019

This pull request has been automatically marked as stale because it has not had recent activity. It will be closed within a week if no further activity occurs, but it only takes a comment to keep a contribution alive :) Also, even if it is closed, you can always reopen the PR when you're ready. Thank you for contributing.

@stale stale bot added the inactive label Sep 8, 2019
@vjFaLk
Copy link
Contributor Author

vjFaLk commented Sep 9, 2019

@rmehta GSuite only allows administrators to do so. Along with that GSuite also forces the user to reset their password once they log in. Also, email sending servers are configurable in Frappe, which means that we might leak the password later down in the chain.

This feature is unnecessary, I've still kept the feature to set a password manually from the backend, why add more features to support a feature that is already posing a security risk?

@netchampfaris
Copy link
Contributor

@vjFaLk Hey, since this is deprecating a feature, we are moving this to v12.

#8449

@github-actions github-actions bot locked as resolved and limited conversation to collaborators Mar 6, 2023
Sign up for free to subscribe to this conversation on GitHub. Already have an account? Sign in.
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

None yet

3 participants