Bugzilla – Full Text Bug Listing
| Summary: | Site login for www.eclipse.org | ||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|
| Product: | Community | Reporter: | Denis Roy <denis.roy> | ||||||||
| Component: | Website | Assignee: | Denis Roy <denis.roy> | ||||||||
| Status: | RESOLVED FIXED | QA Contact: | |||||||||
| Severity: | major | ||||||||||
| Priority: | P3 | CC: | nathan, phoenix.ui-inbox, wayne.beaton | ||||||||
| Version: | unspecified | ||||||||||
| Target Milestone: | --- | ||||||||||
| Hardware: | All | ||||||||||
| OS: | All | ||||||||||
| Whiteboard: | |||||||||||
| Attachments: |
|
||||||||||
|
Description
Denis Roy
Created attachment 83366 [details]
Patch for site login
Here is a patch for a site login. The authentication process is handled via a page that only I have commit access to, but I'm providing API so that anyone can consume the logged in user's information.
For instance, from a typical Phoenix page:
# This will identify a Bugzilla user, registered or not.
$Session = $App->useSession();
# This will get Friend information from the logged in user.
$Friend = $Session->getFriend();
echo "Logged in Bugzilla ID" . $Session->getBugzillaID() . " First Name: " . $Friend->getFirstName();
Created attachment 83428 [details]
Revised patch for site login
I've revised the patch to add session destruction and event logging.
We should note that, although the transmission of the user's Bugzilla credentials to our servers will be protected with https during the authentication phase, this type of session persistence simply relies on a combination of a 256-bit hash and the user's IP subnet over plain http, so security will be fairly low.
Anyone on the same subnet as the user could potentially intercept and impersonate the user's session.
However, for now the risks are low as there won't be much one can do on www.eclipse.org as an authenticated user. The www.eclipse.org session is not tied to the actual Bugzilla application in any way. We should keep this in mind, in case we ever *do* decide to do stuff on our website that would require better security.
Created attachment 83469 [details]
Re-revised patch for site login
OK, this is my final patch. Please review it. I'm quite happy with it.
I added a sqlSanitize($value, $dbh) function in App to prevent SQL injection attacks. This should be used to sanitize anything coming from the browser, before being sent to the DB.
+1 to the code patch, looks good. Nothing big jumps out at me... +1 The site login has been implemented, and the login page is here:
http://dev.eclipse.org/site_login
I updated the Phoenix docs to explain how to use the login information:
http://wiki.eclipse.org/Using_Phoenix
|