Openbravo Issue Tracking System - Retail Modules
View Issue Details
IDProjectCategoryView StatusDate SubmittedLast Update
0045960Retail ModulesWeb POSpublic2021-02-26 13:142022-03-25 06:19
Reportermigueldejuana 
Assigned Toprakashmurugesan88 
PriorityimmediateSeveritycriticalReproducibilityalways
StatusclosedResolutionfixed 
PlatformOS5OS Version
Product Versionpi 
Target VersionFixed in VersionRR21Q2 
Merge Request Statusapproved
Review Assigned To
OBNetwork customerNo
Support ticket
Regression level
Regression date
Regression introduced in release
Regression introduced by commit
Triggers an Emergency PackNo
Summary0045960: We are sending credentials using GET
DescriptionThe request used by Terminal Authentication is using GET method and we are setting credentials in the params.

For security reasons, we must use POST in this case.
Steps To Reproducen/a
Proposed SolutionThis component:

enyo.kind({
  kind: 'enyo.Ajax',
  name: 'OB.OBPOSLogin.UI.LoginRequest',
  classes: 'obObposLoginUiLoginRequest',
  url: '../../org.openbravo.retail.posterminal.service.loginutils',
  method: 'GET',
  handleAs: 'json',
  contentType: 'application/json;charset=utf-8'
});


must use POST and we should handle it properly in MobileCoreLoginUtilsServlet
Additional Information
TagsNo tags attached.
Relationships
depends on backport 0045961RR21Q1 closed prakashmurugesan88 We are sending credentials using GET 
depends on backport 0045962RR20Q4.2 closed prakashmurugesan88 We are sending credentials using GET 
depends on backport 0045963RR20Q3.5 closed prakashmurugesan88 We are sending credentials using GET 
Attached Filespatch I45960_19Q3_MobileCore.patch (6,034) 2022-03-25 06:19
https://issues.openbravo.com/file_download.php?file_id=16806&type=bug
patch I45960_19Q3_PosTerminal.patch (1,119) 2022-03-25 06:19
https://issues.openbravo.com/file_download.php?file_id=16807&type=bug
Issue History
Date ModifiedUsernameFieldChange
2021-02-26 13:14migueldejuanaNew Issue
2021-02-26 13:14migueldejuanaAssigned To => prakashmurugesan88
2021-02-26 13:14migueldejuanaOBNetwork customer => No
2021-02-26 13:14migueldejuanaTriggers an Emergency Pack => No
2021-02-26 13:15migueldejuanaStatusnew => scheduled
2021-03-02 08:03hgbotMerge Request Status => open
2021-03-02 08:03hgbotNote Added: 0126444
2021-03-02 08:04hgbotNote Added: 0126445
2021-03-02 08:28hgbotMerge Request Statusopen => approved
2021-03-02 08:42hgbotResolutionopen => fixed
2021-03-02 08:42hgbotStatusscheduled => closed
2021-03-02 08:42hgbotNote Added: 0126450
2021-03-02 08:42hgbotFixed in Version => RR21Q2
2021-03-02 08:42hgbotNote Added: 0126451
2021-03-02 08:43hgbotNote Added: 0126452
2021-03-02 08:43hgbotNote Added: 0126453
2022-03-24 09:41prakashmurugesan88Statusclosed => new
2022-03-24 09:41prakashmurugesan88Statusnew => scheduled
2022-03-24 09:41prakashmurugesan88Statusscheduled => resolved
2022-03-24 09:41prakashmurugesan88Statusresolved => closed
2022-03-25 06:19prakashmurugesan88File Added: I45960_19Q3_MobileCore.patch
2022-03-25 06:19prakashmurugesan88File Added: I45960_19Q3_PosTerminal.patch

Notes
(0126444)
hgbot   
2021-03-02 08:03   
Merge Request created: https://gitlab.com/openbravo/product/pmods/org.openbravo.mobile.core/-/merge_requests/174 [^]
(0126445)
hgbot   
2021-03-02 08:04   
Merge Request created: https://gitlab.com/openbravo/product/pmods/org.openbravo.retail.posterminal/-/merge_requests/330 [^]
(0126450)
hgbot   
2021-03-02 08:42   
Merge request merged: https://gitlab.com/openbravo/product/pmods/org.openbravo.mobile.core/-/merge_requests/174 [^]
(0126451)
hgbot   
2021-03-02 08:42   
Directly closing issue as related merge request is already approved.

Repository: https://gitlab.com/openbravo/product/pmods/org.openbravo.mobile.core [^]
Changeset: ee625818a81de7d1ac99444ef7cf3b9a7aaf4e61
Author: Prakash M <prakash@qualiantech.com>
Date: 2021-03-01T16:55:42+05:30
URL: https://gitlab.com/openbravo/product/pmods/org.openbravo.mobile.core/-/commit/ee625818a81de7d1ac99444ef7cf3b9a7aaf4e61 [^]

Fixed BUG-45960 : Changed Terminal Authentication request from GET to POST for security purpose
* Included post method in MobileCoreLoginUtilsServlet

---
M src/org/openbravo/mobile/core/login/MobileCoreLoginUtilsServlet.java
---
(0126452)
hgbot   
2021-03-02 08:43   
Directly closing issue as related merge request is already approved.

Repository: https://gitlab.com/openbravo/product/pmods/org.openbravo.retail.posterminal [^]
Changeset: ade6e0956a8bfa6685761bcce7c5878af2796ae6
Author: Prakash M <prakash@qualiantech.com>
Date: 2021-03-02T13:10:52+05:30
URL: https://gitlab.com/openbravo/product/pmods/org.openbravo.retail.posterminal/-/commit/ade6e0956a8bfa6685761bcce7c5878af2796ae6 [^]

Fixed BUG-45960 : Changed Terminal Authentication request from GET to POST for security purpose

---
M web/org.openbravo.retail.posterminal/js/login/model/login-model.js
---
(0126453)
hgbot   
2021-03-02 08:43   
Merge request merged: https://gitlab.com/openbravo/product/pmods/org.openbravo.retail.posterminal/-/merge_requests/330 [^]