Uploaded image for project: 'Moodle'
  1. Moodle
  2. MDL-64190

Site admin password fields should use password config element

    XMLWordPrintable

Details

    • Improvement
    • Status: Closed
    • Minor
    • Resolution: Fixed
    • 3.3.9, 3.4.6, 3.5.3, 3.6.1
    • 3.7
    • Administration, Global search, Quiz
    • MOODLE_33_STABLE, MOODLE_34_STABLE, MOODLE_35_STABLE, MOODLE_36_STABLE
    • MOODLE_37_STABLE
    • Hide
      Prerequisites:
      1. Server with Solr setup. To set up on Linux:
        1. Install SOLR PHP extension. 

          sudo apt install php-solr

        2. Restart Apache. 

          sudo service apache2 restart

        3. Install SOLR 7 docker container. 

          docker run --name solr7 -d -p 8983:8983 -t solr:7

        4. Create index for your Moodle instance (e.g. integrationmaster). 

          docker exec -it --user=solr solr7 bin/solr create_core -c integrationmaster

      Test
      1. Visit Site Administration > Plugins > Search > Solr.
      2. CONFIRM the HTTP authentication password field is a password unmask config element.
      3. Visit Site administration > Plugins > Activity modules > Quiz.
      4. CONFIRM the Require password field is a password unmask config element with and Advanced checkbox in the right.
      Show
      Prerequisites: Server with Solr setup. To set up on Linux: Install SOLR PHP extension. sudo apt install php-solr Restart Apache. sudo service apache2 restart Install SOLR 7 docker container. docker run --name solr7 -d -p 8983:8983 -t solr:7 Create index for your Moodle instance (e.g. integrationmaster). docker exec -it --user=solr solr7 bin/solr create_core -c integrationmaster Test Visit Site Administration > Plugins > Search > Solr. CONFIRM the HTTP authentication password field is a password unmask config element. Visit Site administration > Plugins > Activity modules > Quiz. CONFIRM the Require password field is a password unmask config element with and Advanced checkbox in the right.

    Description

      To prevent credential capture by shoulder surfing and the like, password configuration fields (such as the HTTP authentication password (search_solr | server_password)  should use one of the password config types.

      Attachments

        Issue Links

          has been marked as being related by

          Improvement - An enhancement to an existing Moodle feature. MDL-59326 Don't use password field for shared secrets

          • Minor - Minor loss of function where workaround is possible
          • Closed

          Activity

            People

              pholden Paul Holden
              pholden Paul Holden
              Michael Hawkins Michael Hawkins
              Sara Arjona (@sarjona) Sara Arjona (@sarjona)
              Anna Carissa Sadia Anna Carissa Sadia
              Andrew Lyons, Huong Nguyen, Jun Pataleta, Michael Hawkins, Shamim Rezaie, Simey Lameze, Amaia Anabitarte, Carlos Escobedo, Ferran Recio, Ilya Tregubov, Laurent David, Sara Arjona (@sarjona), Tim Hunt, Andrew Lyons, Huong Nguyen, Jun Pataleta, Michael Hawkins, Shamim Rezaie, Simey Lameze
              Votes:
              0 Vote for this issue
              Watchers:
              4 Start watching this issue

              Dates

                Created:
                Updated:
                Resolved:
                20/May/19

                Time Tracking

                  Estimated:
                  Original Estimate - 0 minutes
                  0m
                  Remaining:
                  Remaining Estimate - 0 minutes
                  0m
                  Logged:
                  Time Spent - 40 minutes
                  40m