adam/Piwigo
1
0 Fork 0
mirror of https://github.com/Piwigo/Piwigo.git synced 2026-10-31 06:02:00 +01:00
Code Issues 657 Packages Projects Releases Wiki Activity

Bug Report:The logon is not encrypted/No login authentication #666

New Issue
Open
opened 2026-10-05 00:10:19 +02:00 by adam · 4 comments
adam commented 2026-10-05 00:10:19 +02:00
Owner
Copy link
Copy source

1.Packet at the login, no encryption
g dimbi8kd3cgvim y r4t

2.There were no restrictions on user input during the test
image

Evironment:
Windows XP Professional
Apache
MySQL
PHP 5.4.45
discovered by: mstteam(Linkey)

1.Packet at the login, no encryption ![g dimbi8kd3cgvim y r4t](https://user-images.githubusercontent.com/25584879/27514117-4501f9a6-59b3-11e7-835d-f512d5d40ab7.png) 2.There were no restrictions on user input during the test ![image](https://user-images.githubusercontent.com/25584879/27514134-10ae85e2-59b4-11e7-87b7-35049e7a67ec.png) Evironment: Windows XP Professional Apache MySQL PHP 5.4.45 discovered by: mstteam(Linkey) <!-- github-sync-id:238363740 -->
adam commented 2026-10-05 00:10:20 +02:00
Author
Owner
Copy link
Copy source

The encryption is made at HTTPS level, if you have it. What other type of encryption are you expecting here?

The encryption is made at HTTPS level, if you have it. What other type of encryption are you expecting here? <!-- github-comment-id:311003917 -->
adam commented 2026-10-05 00:10:20 +02:00
Author
Owner
Copy link
Copy source

@base64linqi see more --> stackoverflow

@base64linqi see more --> [stackoverflow](https://stackoverflow.com/questions/2336678/login-without-https-how-to-secure) <!-- github-comment-id:313596323 -->
adam commented 2026-10-05 00:10:21 +02:00
Author
Owner
Copy link
Copy source

well the whole post on stackoverflow is to point out that there is no viable solution so...

well the whole post on stackoverflow is to point out that there is no viable solution so... <!-- github-comment-id:313643045 -->
adam commented 2026-10-05 00:10:22 +02:00
Author
Owner
Copy link
Copy source

just a passerby here You're inspecting a http request over localhost, so it wouldn't be encrypted. Had you say had some type of self-signed cert and accessed https://localhost it would've shown encrypted. It's usually counter productive (key word usually, I'm sure there are some few special reasons for it) to do encryption over HTTP.

~~just a passerby here~~ You're inspecting a http request over localhost, so it wouldn't be encrypted. Had you say had some type of self-signed cert and accessed https://localhost it would've shown encrypted. It's usually counter productive (key word usually, I'm sure there are some few special reasons for it) to do encryption over HTTP. <!-- github-comment-id:315512844 -->
Sign in to join this conversation.
No Branch/Tag Specified
Labels
No items
No labels
Milestone
No items
No Milestone
Projects
Clear projects
No projects
Assignees
Clear assignees
adam (Adam Wojcieszonek)
No Assignees
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: adam/Piwigo#666