michael/webmin
1
0
Fork 0
mirror of https://github.com/webmin/webmin.git synced 2026-02-03 14:13:29 +00:00
Code Issues Actions Packages Projects Releases Wiki Activity

Fix to show clear warning when trying to reset password over insecure connection

Browse Source
This commit is contained in:
Ilia Ross
2025-09-24 00:15:12 +03:00
parent d1ee0a5ed6
commit 4e229d8adb
2 changed files with 3 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files

3
forgot_form.cgi
View File

@@ -17,7 +17,8 @@ $ENV{'HTTPS'} eq 'ON' || $gconfig{'forgot_pass'} == 2 ||
&error($text{'forgot_essl'});
&ui_print_header(undef, $text{'forgot_title'}, "", undef, undef, 1, 1);
print &ui_alert_box("<b> ⚠ ".$text{'forgot_nossl_warn'}, 'warn')
if ($gconfig{'forgot_pass'} == 2 && $ENV{'HTTPS'} ne 'ON');
print "<center>\n";
print $text{'forgot_desc'},"<p>\n";
print &ui_form_start("forgot_send.cgi", "post");

1
lang/en
View File

@@ -185,6 +185,7 @@ forgot_erate=Too many password reset attempts for $1! Please try again later.
forgot_eremote=Webmin server on this system is not running or is not configured to allow forgotten password recovery.
forgot_essl=Forgotten password recovery can only be used over an SSL connection unless explicitly allowed
forgot_nossl=Yes, and allow over insecure connection
forgot_nossl_warn=Warning: This password reset is being sent over an insecure, not-encrypted connection and is vulnerable to man-in-the-middle (MITM) and header-injection attacks.
pam_header=Login to Webmin
pam_mesg=You must respond to the question below to login to Webmin server on $1.