Submitted by raidensnake on Sat, 01/09/2016 - 23:30
Also Affects Webmin Core
PCI Compliancy Failure:
Details:
Password Autocomplete is on when it should be off
session cookies aren't set to httponly and secure
These issues need fixing as they are causing compliancy failures in PCI DSS 3.0 and 3.1
Files Affected: (List related to debian Jessie but affects all versions)
/usr/share/webmin/authentic-theme/session_login.cgi
/usr/share/webmin/session_login.cgi
Status:
Closed (fixed)
Comments
Just read about this issue. Missed that for 17.40, very sorry. I will take a look at it o the next closes release.
Are you sure it's Authentic Theme bug?
Hi,
Please add this piece of code to the theme extension (JS), to prevent autocomplete on login screen:
$(function () {
// Prevent passwords autocomplete on login screen
if ($("html.session_login").length) {
$(".form-control.session_login").attr("autocomplete", "off");
}
});
It it the theme that has to take care about this?
Submitted by raidensnake on Thu, 01/14/2016 - 12:58 Comment #5
it didn't fix the issue as it's still failing.
Then it has to directly be added to HTML on
session_login.cgifile. It will be done in next release.You could go to the mentioned file and add to
<input type="password">thisautocomplete="off".Does it fix your problem?
Submitted by raidensnake on Thu, 01/14/2016 - 18:01 Comment #7
yes but not the httponly and secure cookie flags. They are still being flagged up.
Submitted by raidensnake on Thu, 01/14/2016 - 18:04 Comment #8
Not being funny these were reported several times and still not fixed.
And was there a problem in the previous theme, with httponly and secure cookie flag?
Submitted by raidensnake on Sun, 01/17/2016 - 01:56 Comment #10
no only autocomplete caused compliancy issues. That was caused by the webmin core. Which is still like that now. it's never been fixed.
I will read more about those standards and in case it's technically possible, I will try to fix it.
Can I run it on my PC to check for results and what is the practical point of having those tests passed?
Submitted by raidensnake on Tue, 01/19/2016 - 09:41 Comment #12
you'd have to use a provider like securitymetrics to run the tests.
I believe I have done all I could on the theme's side (by not saving the login and the password).
I'm closing this issue. If you think I can do more on the theme's side (not Webmin), feel free to re-open it in the future.