Medium Pretorian reported an issue that password is returning is server response is potential threat to system.
The user’s password is returned in the response from the server when an administrator creates an account for a new employee
By sending a user password as a response during account registration, WORKTERRA increases the possibility of the password being sniffed on the wire, or compromised via local workstation access.
When registering a new employee, the employee's default password was displayed to the registrar.
Ideally we should not display password to administrator.
We need to find out all possible locations in System where we are sending password to client side.
Possible solution for this is to remove add employee popup which displays credentials.
Configuration flag should decide whether we need to display newly added employee password in alert or not.
In analysis. We will share ETA by tomorrow.
Hi Vijayendra Shinde ,
Can you please verify analysis document for this if it addresses the requirement ?
Thanks,
Hi Swapnil,
Document looks good to me. You can proceed with development for this. Please make sure we are adding flag in relevant section on Security page.
Thanks.
Due to short of bandwidth , we are keeping this enhancement on Hold.
Hi Chaitali,
We will start with this enhancement today.
Started with the enhancement today.
Code related changes are committed on LB
DB Script changes are yet to be deployed on LB .It will be deployed on LB tomorrow.
So will change the status accordingly tomorrow.
Deepali Tidke
This is deployed on LB.
Please note that if the employee is not given any email address while adding him into the system the credentials will not be sent to anyone(employee nor admin).
Checked into Stage
Please assign this ticket to someone
kindly check this and discuss once with Venkatesh before starting it.
Verified on stage.
Company name:- 1.OCSD for hspl
2.City of Durham For HSPL
Log in:-1.Partner
2.Admin
On security page system displayed check box for 'To Display Password on Add Employee.'
Admin/partner can check or uncheck check box for password.
refer attached screenshot.
On Add employee page system not displayed employee credential for uncheck.
Employee credential pop up displayed when check box is selected.
Refer attached screenshot.
above scenarios tested for benadmin & Recruit module.
For SEO testing is in progress.
Dhanashree Sherkar (Inactive)
added a comment - Verified on stage.
Company name:- 1.OCSD for hspl
2.City of Durham For HSPL
Log in:-1.Partner
2.Admin
On security page system displayed check box for 'To Display Password on Add Employee.'
Admin/partner can check or uncheck check box for password.
refer attached screenshot.
On Add employee page system not displayed employee credential for uncheck.
Employee credential pop up displayed when check box is selected.
Refer attached screenshot.
above scenarios tested for benadmin & Recruit module.
For SEO testing is in progress.
Foe SEO also it is checked. ready for production.
kindly check this on production
We have verified the enhancement on Production for BenAdmin & Recruit module, working as expected.
Kunal Kedari (Inactive)
added a comment - We have verified the enhancement on Production for BenAdmin & Recruit module, working as expected.
Due to other priority tasks, keeping this in Backlog.