-
Type:
Bug
-
Status: Closed
-
Priority:
Medium
-
Resolution: Done
-
Affects Version/s: None
-
Fix Version/s: None
-
Component/s: None
-
Labels:None
-
Environment:Production
-
Module:BenAdmin - Security
-
Reported by:Harbinger
-
Item State:Production QA
[Secure Test] Request Details of Get URL for viewing Benefit Descriptions are having parameters as plain text and using same URL plan descriptions can be accessed across company.
Start Tamper Data plugin for viewing Request Details.
1. Login as Admin to Company 2.
2. Login as Employee to Company 1
3. Traverse Employee Self Serve mode to Enroll now plans like Medical,Dental,Vision etc.
4. Click on Benefit Description
5. Go to Tamper Data and check for the Request Details. Refer Screen Shots for details.
6. Copy the URL and paste it in the Admin user's session of company 2
7. Using same URL plan descriptions can be accessed across company.
Refer screenshots for details
Hi Vijayendra Shinde
Security Testing completed on Production for this issue.
Thanks
-Prasad
CC : SamirVijay SiddhaRakesh Roy
Environment: Stage
Company: ASML for Hspl
The patch is tested for Benefit description functionality on Stage.
Steps:
1. Benefit Description Added for Medical and Dental plans.
2. Benefit Type > Marked the check box for Benefit description drop down.
3. Add/Change Plan Design > Employees must view Benefit Description dropdown > Yes > Save
4., Employee Login > Enroll Now Page > Medical Plan must have Benefit description
5. Benefit Description Button > Benefit Description popup > Doc should open
As the link appears for fraction of sec. so not able to copy the link and check with other company Admin.
For the functionality of Benefit Description functionality it is working as expected. So, moving the jira on further step.
Prasad Pise: Assigning the jira to you for Production security testing.
As mentioned above, assigned ticket to Rakesh Roy for functional testing.
Issue verified on Stage after patch deployment. I tried by removing the value of parameter "encryptedCompanyID" and hit Enter key. No Plan details displayed.
User is asked to click on "Return to home page" button.
Thanks
- Prasad
Environment: Production
Company: El Camino Hospital For HSPL
Login: Employee and Partner
The patch is tested for Benefit description functionality on Production.
Steps:
1. Benefit Description Added for Medical plans.
2. Benefit Type > Marked the check box for Benefit Description drop down.
3. Add/Change Plan Design > Employees must view Benefit Description dropdown > Yes > Save
4. Employee Login > Enroll Now Page > Medical Plan must have Benefit Description OR
Partner login> Serach Employee > Benefits > Enroll now > Benefit Description
5. Benefit Description Button > Benefit Description popup > Doc opens
As mentioned during Stage Testing, the link appears for fraction of sec. so not able to copy the link and check with other company Admin.
For the functionality of Benefit Description functionality it is working as expected on production. So, closing the jira on production.