#2521: Weather shouldn't use the confirm_auth string in the URL of the /pending/
page
--------------------------+-------------------------------------------------
Reporter: kaner | Owner: kaner
Type: defect | Status: new
Priority: normal | Milestone:
Component: Tor Weather | Version:
Keywords: | Parent:
Points: | Actualpointsdone:
Pointsdone: | Actualpoints:
--------------------------+-------------------------------------------------
Currently Weather forwards a newly subscribed user to the /pending/ page,
passing on the confirm_auth string in the URL. This is a bad idea from a
security point of view. Nicolas Pouillard reported this issue (thanks!).
It is currently worked around in the live version of Weather.
A real fix might need a redesign of some parts or workflows in Weather.
--
Ticket URL: <https://trac.torproject.org/projects/tor/ticket/2521>
Tor Bug Tracker & Wiki <https://trac.torproject.org/>
The Tor Project: anonymity online
_______________________________________________
tor-bugs mailing list
[email protected]
https://lists.torproject.org/cgi-bin/mailman/listinfo/tor-bugs
