Login screen bypass
-
Good evening,
I’ve gone through the code quickly and found a way a person can bypass the login screen. If you create a cookie with the name simple_limited_access and current date in format Ymd, you are able to bypass the login screen. With that in mind, the login page will be showed to the user every day regardless of the cookie expiration setting, if it’s set for more than 24h. Please consider using safer approach for example the cookie could contain uuid, which would be then validated against database row.
Viewing 1 replies (of 1 total)
Viewing 1 replies (of 1 total)
- The topic ‘Login screen bypass’ is closed to new replies.