{"action":"closed","issue":{"url":"https://api.github.com/repos/TheRosettaFoundation/SOLAS-Match/issues/1169","repository_url":"https://api.github.com/repos/TheRosettaFoundation/SOLAS-Match","labels_url":"https://api.github.com/repos/TheRosettaFoundation/SOLAS-Match/issues/1169/labels{/name}","comments_url":"https://api.github.com/repos/TheRosettaFoundation/SOLAS-Match/issues/1169/comments","events_url":"https://api.github.com/repos/TheRosettaFoundation/SOLAS-Match/issues/1169/events","html_url":"https://github.com/TheRosettaFoundation/SOLAS-Match/issues/1169","id":74687250,"number":1169,"title":"Security issues","user":{"login":"alanbarrett","id":609791,"avatar_url":"https://avatars.githubusercontent.com/u/609791?v=3","gravatar_id":"","url":"https://api.github.com/users/alanbarrett","html_url":"https://github.com/alanbarrett","followers_url":"https://api.github.com/users/alanbarrett/followers","following_url":"https://api.github.com/users/alanbarrett/following{/other_user}","gists_url":"https://api.github.com/users/alanbarrett/gists{/gist_id}","starred_url":"https://api.github.com/users/alanbarrett/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/alanbarrett/subscriptions","organizations_url":"https://api.github.com/users/alanbarrett/orgs","repos_url":"https://api.github.com/users/alanbarrett/repos","events_url":"https://api.github.com/users/alanbarrett/events{/privacy}","received_events_url":"https://api.github.com/users/alanbarrett/received_events","type":"User","site_admin":false},"labels":[{"url":"https://api.github.com/repos/TheRosettaFoundation/SOLAS-Match/labels/security","name":"security","color":"e10c02"}],"state":"closed","locked":false,"assignee":null,"assignees":[],"milestone":null,"comments":4,"created_at":"2015-05-09T14:41:55Z","updated_at":"2016-10-14T14:32:04Z","closed_at":"2016-10-14T14:32:04Z","body":"There are a number of security issues.\r\n\r\n1) HTTPS should be used for login\r\n\r\n2) The default Slim configuration has cookies.encrypt set to false.\r\nSuggested approach from doc...\r\n$app = new \\Slim\\Slim(array(\r\n    'cookies.encrypt' => true,\r\n    'cookies.secret_key' => 'YOUR_SECRET_KEY',\r\n    'cookies.cipher' => MCRYPT_RIJNDAEL_256,\r\n    'cookies.cipher_mode' => MCRYPT_MODE_CBC\r\n));\r\nAlso, if you're using mcrypt as the above example don't forget to install the extension.\r\n...\r\nThe problem is that the way sessions are done in Slim is to store the whole session in a cookie rather than an ID, so data is visible.\r\n\r\n3) static/getUserHash/ is plain text and not encrypted. So this is not a secure way of communicating.\r\n\r\n4) The static/getUserHash/ Ajax call from Parameters.js seems (using IE?) to sometimes not return a hash.\r\nThis would cause some direct calls such as checking if a project name already exists to fail (actually call will not get made in this case).\r\nThis is not repeatable and seems not to happen when network monitoring is on!\r\nIt is also not a catastrophic situation as the form submit will catch the error later.\r\nHowever, this hash does not add any real security as currently configured and should be reviewed.\r\n\r\nA overall review of security should be done.\r\n\r\n    Alan."}}
{"actor":{"display_login":"alanbarrett"}}