search

spicywebau / craft-fieldlabels

Override Craft CMS field labels and instructions in the field layout designer
MIT License
123 stars 9 forks source link

Security issue: private admin field labels and instructions being leaked in login screen source code #12

Closed SimonEast closed 5 years ago

SimonEast commented 7 years ago

I just noticed that when viewing the source code of my Craft login screen, the relabel plugin seems to be dumping all its JSON data there. Since this could potentially include private data that includes field names and instructions intended for admin users only, it would be great if this was excluded from the login screen and any other screens that are potentially accessible by non-admins.

See example here: http://ku.staging7.yump.com.au/admin/login (will remove this link shortly)

I don't have time right now to submit a patch, but if there is someone else willing to, that would be great.

Simon.

ttempleton commented 5 years ago

This issue has been resolved in the Craft 3 version of the original Relabel, which is now known as Field Labels.