1. 20 Nov, 2014 2 commits
    • Robert Lyon's avatar
      Session is not invalidating after password change (Bug #1363873) · 26095d3c
      Robert Lyon authored
      
      
      Scenario/testing:
      
      - Create an account, say User A and logout as admin.
      - In one browser login (this will be the hacker user)
      - In another browser reset pass via forgotten pass link
      
      What should happen:
      User in browser two should be able to reset pass then navigate about
      as when normally logged in. User in browser one should be forced to
      login again as their user sessionid is not valid anymore.
      
      Before patch:
      malicious user still has access until $USER->logout_time time expires
      
      After patch:
      malicious user foreced to re-login straight away on next page load
      
      Change-Id: I42ad907e5ffa7c128742a159116cf20dc6cd9b8a
      Signed-off-by: Robert Lyon's avatarRobert Lyon <robertl@catalyst.net.nz>
      26095d3c
    • Son Nguyen's avatar
      Add the group.php library. Bug 1391621 · ac990d28
      Son Nguyen authored and Robert Lyon's avatar Robert Lyon committed
      
      
      This lib provides the function group_homepage_url()
      Backporting bug 1313963
      
      Change-Id: I70c1c3b411180758a9bcc363aa3377513c915a19
      Signed-off-by: default avatarSon Nguyen <son.nguyen@catalyst.net.nz>
      ac990d28
  2. 12 Nov, 2014 1 commit
  3. 11 Nov, 2014 3 commits
  4. 06 Nov, 2014 4 commits
  5. 05 Nov, 2014 3 commits
  6. 29 Oct, 2014 3 commits
  7. 23 Oct, 2014 2 commits
  8. 21 Oct, 2014 17 commits
  9. 20 Oct, 2014 5 commits