Closed
Milestone
Apr 11, 2019–May 12, 2019
2.0.4
Unstarted Issues (open and unassigned)
0
Ongoing Issues (open and assigned)
0
Completed Issues (closed)
28
- [Security: low] register_token used for account creation can be used as a valid session identifier
- [Security: high, CVE-2019-12046] Setting tokenUseGlobalStorage allows unauthenticated users to access the portal (and applications without rules)
- [Security:minor] Update jQuery
- Deleted category is not detected as a change when saving conf.
- Error not well catched with Ext2F
- Configuration version in Manager is different from software version
- Invalid default crontab in RPM
- Deb package: missing dependency IO::String
- CAS 1.0 /validate endpoint does not return username
- Duplicate session opening when using multiple Kerberos instances in Combination
- Configuration keys not displayed in Viewer
- ViewDiff template not displayed
- UI manager: boolean values do not appears in configuration forms with Yaml config format
- Improve log in Grant Session plugin
- Highlight valid SSO sessions in sessions explorer
- Sort real and spoofed attributes in CheckUser and Session explorer
- Display error if SAML service is enabled without private and public keys signature
- Improve redirect page
- Allow unauthenticated clients on OIDC token endpoint
- [Security: improvement] PKCE to secure OIDC Authorization Code flow
- MongoDB Sessions Purge - DEPRECATION WARNING
- Clean language templates
- Check logLevel value
- CAS : Allow per application CAS login override
- Display idpChoice cancel button only if AuthChoice is enabled
- Return Session ID when authentication is done via REST
- Fix faulty headers on a null value
- Allow Handler to read OAuth2 access token instead of browser cookie
