{"action":"created","issue":{"url":"https://api.github.com/repos/apple/cups/issues/4840","repository_url":"https://api.github.com/repos/apple/cups","labels_url":"https://api.github.com/repos/apple/cups/issues/4840/labels{/name}","comments_url":"https://api.github.com/repos/apple/cups/issues/4840/comments","events_url":"https://api.github.com/repos/apple/cups/issues/4840/events","html_url":"https://github.com/apple/cups/issues/4840","id":160416397,"number":4840,"title":"Cups 2.1.3 Admin Login Fails when root password same as a user password","user":{"login":"carlocapocasa","id":1167940,"avatar_url":"https://avatars.githubusercontent.com/u/1167940?v=3","gravatar_id":"","url":"https://api.github.com/users/carlocapocasa","html_url":"https://github.com/carlocapocasa","followers_url":"https://api.github.com/users/carlocapocasa/followers","following_url":"https://api.github.com/users/carlocapocasa/following{/other_user}","gists_url":"https://api.github.com/users/carlocapocasa/gists{/gist_id}","starred_url":"https://api.github.com/users/carlocapocasa/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/carlocapocasa/subscriptions","organizations_url":"https://api.github.com/users/carlocapocasa/orgs","repos_url":"https://api.github.com/users/carlocapocasa/repos","events_url":"https://api.github.com/users/carlocapocasa/events{/privacy}","received_events_url":"https://api.github.com/users/carlocapocasa/received_events","type":"User","site_admin":false},"labels":[{"url":"https://api.github.com/repos/apple/cups/labels/Cannot%20Reproduce","name":"Cannot Reproduce","color":"666666"}],"state":"open","locked":false,"assignee":{"login":"michaelrsweet","id":488103,"avatar_url":"https://avatars.githubusercontent.com/u/488103?v=3","gravatar_id":"","url":"https://api.github.com/users/michaelrsweet","html_url":"https://github.com/michaelrsweet","followers_url":"https://api.github.com/users/michaelrsweet/followers","following_url":"https://api.github.com/users/michaelrsweet/following{/other_user}","gists_url":"https://api.github.com/users/michaelrsweet/gists{/gist_id}","starred_url":"https://api.github.com/users/michaelrsweet/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/michaelrsweet/subscriptions","organizations_url":"https://api.github.com/users/michaelrsweet/orgs","repos_url":"https://api.github.com/users/michaelrsweet/repos","events_url":"https://api.github.com/users/michaelrsweet/events{/privacy}","received_events_url":"https://api.github.com/users/michaelrsweet/received_events","type":"User","site_admin":false},"milestone":null,"comments":4,"created_at":"2016-06-15T13:02:18Z","updated_at":"2016-06-16T20:04:38Z","closed_at":null,"body":"To reproduce:\r\n\r\n1. Set root password of a linux test system to foobar22\r\n1. Set password of current user to foobar22\r\n1  Go to localhost:631 in Cups 2.1.3\r\n1. Click \"Administration\"\r\n1. Click \"Add Printer\"\r\n1. Enter root as username, foobar22 as password\r\n\r\nExpected behavior: Login occurs\r\nActual behavior: The baseauth password form is displayed again, as is default browser behavior for an incorrect password\r\n\r\nI was unable to come up with a specific scenario, but there is a theoretical security issue with this, because information about user passwords is leaked to the root user (and potentially any user with cups admin access)"},"comment":{"url":"https://api.github.com/repos/apple/cups/issues/comments/226597683","html_url":"https://github.com/apple/cups/issues/4840#issuecomment-226597683","issue_url":"https://api.github.com/repos/apple/cups/issues/4840","id":226597683,"user":{"login":"carlocapocasa","id":1167940,"avatar_url":"https://avatars.githubusercontent.com/u/1167940?v=3","gravatar_id":"","url":"https://api.github.com/users/carlocapocasa","html_url":"https://github.com/carlocapocasa","followers_url":"https://api.github.com/users/carlocapocasa/followers","following_url":"https://api.github.com/users/carlocapocasa/following{/other_user}","gists_url":"https://api.github.com/users/carlocapocasa/gists{/gist_id}","starred_url":"https://api.github.com/users/carlocapocasa/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/carlocapocasa/subscriptions","organizations_url":"https://api.github.com/users/carlocapocasa/orgs","repos_url":"https://api.github.com/users/carlocapocasa/repos","events_url":"https://api.github.com/users/carlocapocasa/events{/privacy}","received_events_url":"https://api.github.com/users/carlocapocasa/received_events","type":"User","site_admin":false},"created_at":"2016-06-16T20:04:37Z","updated_at":"2016-06-16T20:04:37Z","body":"Thanks for checking. I'll get back to you.\nOn Jun 15, 2016 4:05 PM, \"Michael R Sweet\" <notifications@github.com> wrote:\n\n> What Linux distribution?\n>\n> Are you compiling CUPS from source or using a package from the\n> distribution?\n>\n> —\n> You are receiving this because you authored the thread.\n> Reply to this email directly, view it on GitHub\n> <https://github.com/apple/cups/issues/4840#issuecomment-226197334>, or mute\n> the thread\n> <https://github.com/notifications/unsubscribe/ABHSRBH1MgoCuDmkq53PGhaivFUgY-8Tks5qMAaagaJpZM4I2VNf>\n> .\n>\n"}}
{"actor":{"display_login":"carlocapocasa"}}