Re: [Django] #23066: Already logged-in user remains logged in when RemoteUser authentication of new user fails

[Django]

#23066: Already logged-in user remains logged in when RemoteUser authentication 
of
new user fails
-+-
 Reporter:  david.greisen@…  |Owner:  nobody
 Type:  Bug  |   Status:  closed
Component:  contrib.auth |  Version:  master
 Severity:  Normal   |   Resolution:  fixed
 Keywords:  remoteUserBackend| Triage Stage:  Accepted
  RemoteUserMiddleware   |  Needs documentation:  0
Has patch:  1|  Patch needs improvement:  0
  Needs tests:  1|UI/UX:  0
Easy pickings:  0|
-+-

Comment (by Tim Graham ):

 In [changeset:"1a45d059c70385fcd6f4a3955f3b4e4cc96d0150"]:
 {{{
 #!CommitTicketReference repository=""
 revision="1a45d059c70385fcd6f4a3955f3b4e4cc96d0150"
 [1.7.x] Fixed #23066 -- Modified RemoteUserMiddleware to logout on
 REMOTE_USER change.

 This is a security fix. Disclosure following shortly.
 }}}

-- 
Ticket URL: 
Django 
The Web framework for perfectionists with deadlines.

-- 
You received this message because you are subscribed to the Google Groups 
"Django updates" group.
To unsubscribe from this group and stop receiving emails from it, send an email 
to django-updates+unsubscr...@googlegroups.com.
To post to this group, send email to django-updates@googlegroups.com.
To view this discussion on the web visit 
https://groups.google.com/d/msgid/django-updates/080.20aed0bf67bdcda97cc891864057528d%40djangoproject.com.
For more options, visit https://groups.google.com/d/optout.

Re: [Django] #23066: Already logged-in user remains logged in when RemoteUser authentication of new user fails

[Django]

#23066: Already logged-in user remains logged in when RemoteUser authentication 
of
new user fails
-+-
 Reporter:  david.greisen@…  |Owner:  nobody
 Type:  Bug  |   Status:  closed
Component:  contrib.auth |  Version:  master
 Severity:  Normal   |   Resolution:  fixed
 Keywords:  remoteUserBackend| Triage Stage:  Accepted
  RemoteUserMiddleware   |  Needs documentation:  0
Has patch:  1|  Patch needs improvement:  0
  Needs tests:  1|UI/UX:  0
Easy pickings:  0|
-+-

Comment (by Tim Graham ):

 In [changeset:"dd68f319b365f6cb38c5a6c106faf4f6142d7d88"]:
 {{{
 #!CommitTicketReference repository=""
 revision="dd68f319b365f6cb38c5a6c106faf4f6142d7d88"
 [1.5.x] Fixed #23066 -- Modified RemoteUserMiddleware to logout on
 REMOTE_USE change.

 This is a security fix. Disclosure following shortly.
 }}}

-- 
Ticket URL: 
Django 
The Web framework for perfectionists with deadlines.

-- 
You received this message because you are subscribed to the Google Groups 
"Django updates" group.
To unsubscribe from this group and stop receiving emails from it, send an email 
to django-updates+unsubscr...@googlegroups.com.
To post to this group, send email to django-updates@googlegroups.com.
To view this discussion on the web visit 
https://groups.google.com/d/msgid/django-updates/080.175945252dade7e1832b10ca3772a59d%40djangoproject.com.
For more options, visit https://groups.google.com/d/optout.

Re: [Django] #23066: Already logged-in user remains logged in when RemoteUser authentication of new user fails

[Django]

#23066: Already logged-in user remains logged in when RemoteUser authentication 
of
new user fails
-+-
 Reporter:  david.greisen@…  |Owner:  nobody
 Type:  Bug  |   Status:  closed
Component:  contrib.auth |  Version:  master
 Severity:  Normal   |   Resolution:  fixed
 Keywords:  remoteUserBackend| Triage Stage:  Accepted
  RemoteUserMiddleware   |  Needs documentation:  0
Has patch:  1|  Patch needs improvement:  0
  Needs tests:  1|UI/UX:  0
Easy pickings:  0|
-+-

Comment (by Tim Graham ):

 In [changeset:"c9e3b9949cd55f090591fbdc4a114fcb8368b6d9"]:
 {{{
 #!CommitTicketReference repository=""
 revision="c9e3b9949cd55f090591fbdc4a114fcb8368b6d9"
 [1.4.x] Fixed #23066 -- Modified RemoteUserMiddleware to logout on
 REMOTE_USE change.

 This is a security fix. Disclosure following shortly.
 }}}

-- 
Ticket URL: 
Django 
The Web framework for perfectionists with deadlines.

-- 
You received this message because you are subscribed to the Google Groups 
"Django updates" group.
To unsubscribe from this group and stop receiving emails from it, send an email 
to django-updates+unsubscr...@googlegroups.com.
To post to this group, send email to django-updates@googlegroups.com.
To view this discussion on the web visit 
https://groups.google.com/d/msgid/django-updates/080.65347f1a8a6f3676c0fa1b3a99dbbd3e%40djangoproject.com.
For more options, visit https://groups.google.com/d/optout.

Re: [Django] #23066: Already logged-in user remains logged in when RemoteUser authentication of new user fails

[Django]

#23066: Already logged-in user remains logged in when RemoteUser authentication 
of
new user fails
-+-
 Reporter:  david.greisen@…  |Owner:  nobody
 Type:  Bug  |   Status:  closed
Component:  contrib.auth |  Version:  master
 Severity:  Normal   |   Resolution:  fixed
 Keywords:  remoteUserBackend| Triage Stage:  Accepted
  RemoteUserMiddleware   |  Needs documentation:  0
Has patch:  1|  Patch needs improvement:  0
  Needs tests:  1|UI/UX:  0
Easy pickings:  0|
-+-

Comment (by Tim Graham ):

 In [changeset:"5307ce565fbedb9cc27cbe7c757b41a00438d37c"]:
 {{{
 #!CommitTicketReference repository=""
 revision="5307ce565fbedb9cc27cbe7c757b41a00438d37c"
 Fixed #23066 -- Modified RemoteUserMiddleware to logout on REMOTE_USER
 change.

 This is a security fix. Disclosure following shortly.
 }}}

-- 
Ticket URL: 
Django 
The Web framework for perfectionists with deadlines.

-- 
You received this message because you are subscribed to the Google Groups 
"Django updates" group.
To unsubscribe from this group and stop receiving emails from it, send an email 
to django-updates+unsubscr...@googlegroups.com.
To post to this group, send email to django-updates@googlegroups.com.
To view this discussion on the web visit 
https://groups.google.com/d/msgid/django-updates/080.fa79068413acde8768f98c5fb2526fd0%40djangoproject.com.
For more options, visit https://groups.google.com/d/optout.

Re: [Django] #23066: Already logged-in user remains logged in when RemoteUser authentication of new user fails

[Django]

#23066: Already logged-in user remains logged in when RemoteUser authentication 
of
new user fails
-+-
 Reporter:  david.greisen@…  |Owner:  nobody
 Type:  Bug  |   Status:  closed
Component:  contrib.auth |  Version:  master
 Severity:  Normal   |   Resolution:  fixed
 Keywords:  remoteUserBackend| Triage Stage:  Accepted
  RemoteUserMiddleware   |  Needs documentation:  0
Has patch:  1|  Patch needs improvement:  0
  Needs tests:  1|UI/UX:  0
Easy pickings:  0|
-+-
Changes (by Tim Graham ):

 * status:  new => closed
 * resolution:   => fixed


Comment:

 In [changeset:"0268b855f9eab3377f2821164ef3e66037789e09"]:
 {{{
 #!CommitTicketReference repository=""
 revision="0268b855f9eab3377f2821164ef3e66037789e09"
 [1.6.x] Fixed #23066 -- Modified RemoteUserMiddleware to logout on
 REMOTE_USE change.

 This is a security fix. Disclosure following shortly.
 }}}

-- 
Ticket URL: 
Django 
The Web framework for perfectionists with deadlines.

-- 
You received this message because you are subscribed to the Google Groups 
"Django updates" group.
To unsubscribe from this group and stop receiving emails from it, send an email 
to django-updates+unsubscr...@googlegroups.com.
To post to this group, send email to django-updates@googlegroups.com.
To view this discussion on the web visit 
https://groups.google.com/d/msgid/django-updates/080.1310ce34602d40a32bb273586bd6aeda%40djangoproject.com.
For more options, visit https://groups.google.com/d/optout.

Re: [Django] #23066: Already logged-in user remains logged in when RemoteUser authentication of new user fails

[Django]

#23066: Already logged-in user remains logged in when RemoteUser authentication 
of
new user fails
-+-
 Reporter:  david.greisen@…  |Owner:  nobody
 Type:  Bug  |   Status:  new
Component:  contrib.auth |  Version:  master
 Severity:  Normal   |   Resolution:
 Keywords:  remoteUserBackend| Triage Stage:  Accepted
  RemoteUserMiddleware   |  Needs documentation:  0
Has patch:  1|  Patch needs improvement:  0
  Needs tests:  1|UI/UX:  0
Easy pickings:  0|
-+-
Changes (by timo):

 * stage:  Unreviewed => Accepted


-- 
Ticket URL: 
Django 
The Web framework for perfectionists with deadlines.

-- 
You received this message because you are subscribed to the Google Groups 
"Django updates" group.
To unsubscribe from this group and stop receiving emails from it, send an email 
to django-updates+unsubscr...@googlegroups.com.
To post to this group, send email to django-updates@googlegroups.com.
To view this discussion on the web visit 
https://groups.google.com/d/msgid/django-updates/080.b33fce05d2ff052cb31ed45dad9b28e2%40djangoproject.com.
For more options, visit https://groups.google.com/d/optout.

Re: [Django] #23066: Already logged-in user remains logged in when RemoteUser authentication of new user fails

[Django]

#23066: Already logged-in user remains logged in when RemoteUser authentication 
of
new user fails
-+-
 Reporter:  david.greisen@…  |Owner:  nobody
 Type:  Bug  |   Status:  new
Component:  contrib.auth |  Version:  master
 Severity:  Normal   |   Resolution:
 Keywords:  remoteUserBackend| Triage Stage:
  RemoteUserMiddleware   |  Unreviewed
Has patch:  1|  Needs documentation:  0
  Needs tests:  1|  Patch needs improvement:  0
Easy pickings:  0|UI/UX:  0
-+-
Changes (by timo):

 * needs_docs:   => 0
 * has_patch:  0 => 1
 * needs_tests:   => 1
 * easy:  1 => 0
 * needs_better_patch:   => 0


Comment:

 If this is a security issue that can be exploited by an attacker, please
 [https://docs.djangoproject.com/en/dev/internals/security/#reporting-
 security-issues report the details privately]. If this is simply security
 hardening, then it's fine to post more details here.

 As far as I can tell, Django's normal authentication doesn't implement the
 protocol of logging out an existing user after a failed login attempt.
 Could you elaborate (to the security@ alias if necessary) on why
 `RemoteUserMiddleware` needs to do so? Thanks.

 (to be merged, the patch would also need a test)

-- 
Ticket URL: 
Django 
The Web framework for perfectionists with deadlines.

-- 
You received this message because you are subscribed to the Google Groups 
"Django updates" group.
To unsubscribe from this group and stop receiving emails from it, send an email 
to django-updates+unsubscr...@googlegroups.com.
To post to this group, send email to django-updates@googlegroups.com.
To view this discussion on the web visit 
https://groups.google.com/d/msgid/django-updates/080.f24b883427ee67d8e0bdb23f6d735b52%40djangoproject.com.
For more options, visit https://groups.google.com/d/optout.

[Django] #23066: Already logged-in user remains logged in when RemoteUser authentication of new user fails

[Django]

#23066: Already logged-in user remains logged in when RemoteUser authentication 
of
new user fails
-+-
 Reporter:   |  Owner:  nobody
  david.greisen@…| Status:  new
 Type:  Bug  |Version:  master
Component:   |   Keywords:  remoteUserBackend
  contrib.auth   |  RemoteUserMiddleware
 Severity:  Normal   |  Has patch:  0
 Triage Stage:   |  UI/UX:  0
  Unreviewed |
Easy pickings:  1|
-+-
 Currently, when remoteUserBackend fails to authenticate the
 username passed in the header, and create_unknown_user==False,
 RemoteUserMiddleware does nothing. Thus, if a different user
 was logged in, that user will remain logged in despite the failed
 attempt to log in a new user.

 This is a security issue.

 https://github.com/django/django/pull/2936 fixes this problem
 by logging out the request if the user returned
 by the middleware is None (a failed login attempt).

-- 
Ticket URL: 
Django 
The Web framework for perfectionists with deadlines.

-- 
You received this message because you are subscribed to the Google Groups 
"Django updates" group.
To unsubscribe from this group and stop receiving emails from it, send an email 
to django-updates+unsubscr...@googlegroups.com.
To post to this group, send email to django-updates@googlegroups.com.
To view this discussion on the web visit 
https://groups.google.com/d/msgid/django-updates/065.d0fb90094277fee2d0bfbd2cf9da7d1b%40djangoproject.com.
For more options, visit https://groups.google.com/d/optout.