Details
-
Bug
-
Resolution: Fixed
-
Critical
-
6.2.1
-
Unit
-
Unknown
-
N/A
-
N/A
-
Description
Steps to reproduce:
Open /xwiki/bin/get/XWiki/LiveTableResults?outputSyntax=plain&password_class=XWiki.XWikiUsers&collist=password&password=hash:SHA-512:c
Modify the filter as explained in XWIKI-19949 to recover the full password hash.
Expected result:
Results aren't filtered by the password column, so all documents are returned.
Actual result:
The filter is applied as the check added for fixing XWIKI-19949 doesn't consider the class passed via the _class parameters.
I've indicated the same affects version as XWIKI-19949.
Attachments
Issue Links
- is related to
-
XWIKI-19949 Livetable results allow reconstructing password hashes using 768 requests
-
- Closed
-
- links to