[
https://issues.apache.org/jira/browse/OFBIZ-4361?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=13079787#comment-13079787
]
Sam Hamilton commented on OFBIZ-4361:
-------------------------------------
I would suggest that the forgot password emails the user a one time url to
verify that they want to change their password and only after the link has been
clicked are you able to change the password, I wouldn't have it email a
password but rather give the user the option to set their own on the server.
Its slightly more secure as email is not encrypted and the password could be
intercepted and the new password page could be forced to go over SSL.
I would prefer to keep the forgot password form as simple as possible so either
ask for their username or their password but not both. I think that most people
using the ecommerce app probably set their users username to their email
address anyway.
> Any ecommerce user has the ability to reset anothers password (including
> admin) via "Forget Your Password"
> ----------------------------------------------------------------------------------------------------------
>
> Key: OFBIZ-4361
> URL: https://issues.apache.org/jira/browse/OFBIZ-4361
> Project: OFBiz
> Issue Type: Bug
> Components: framework
> Affects Versions: Release Branch 11.04, SVN trunk
> Environment: Ubuntu and others
> Reporter: mz4wheeler
> Priority: Critical
> Labels: security
>
> Currently, any user (via ecommerce "Forget Your Password") has the ability to
> reset another users password, including "admin" without permission. By
> simply entering "admin" and clicking "Email Password", the following is
> displayed.
> The following occurred:
> A new password has been created and sent to you. Please check your Email.
> This now forces the user of the ERP to change their password. It is also
> possible to generate a dictionary attack against ofbiz because there is no
> capta code required. This is serious security risk.
> This feature could be reduced to a certain sub-set of users, whose login name
> is optionally in the format of an email address, and maybe require a capta
> code to prevent dictionary attacks.
> For example, limit the feature to role "Customer" of type "Person" which was
> generated via an ecommerce transaction.
--
This message is automatically generated by JIRA.
For more information on JIRA, see: http://www.atlassian.com/software/jira
