Why is the password visible in the session?

Hi,

I am wondering why the password is displayed when you use a snippet with the following code:

echo "<pre>" . print_r($_SESSION, true) . "</pre>";

Here’s the output



Shouldn’t the password always be encrypted in the DB?

I think that’s the password entered on login by the current user. The one in the DB is a hash value. That means the session variable would never hold someone else’s password, just what the current user entered in the login process.

Hi Bob,

Isn’t that the same thing as I always enter my password when I login?
Is there any reason for the password to be in that array?

Quote from: cipa at Oct 28, 2010, 11:27 PM

Hi Bob,

Isn’t that the same thing as I always enter my password when I login?
Is there any reason for the password to be in that array?

I’m just guessing, but I think the login snippet and the Manager login page set that value for later comparison with the hash value in the DB to authenticate the user. I would think it should be unset once the user is logged in. Have you tried it from another browser where you’re not logged on in the Manager?

Hi Bob,

I am not familiar with Revo’s way of doing things but I don’t see a reason to save the password in a session.

cipa, can you file that as a bug here and we’ll try and look at it for 2.0.5: http://bugs.modx.com/

http://bugs.modx.com/issues/2666