let me describe a scenario - i'm a hacker who writes a simple program that uses an incremementing number to profile a site e.g. it will visit www.mysite.com/default.aspx?tabid=1 then www.mysite.com/default.aspx?tabid=2 then www.mysite.com/default.aspx?tabid=3 etc. As each page is visited the hacker doesn't have permissions so they're redirected to a login page (or tab) which is what we want. However, before the change the original pages title was preserved, so the hacker could see that tabid 1 was a page known as "About us", tabid 2 was a page known as "contact" and tabid 3 was a page known as "Password list" -this information leakage would be very handy and allow hackers to target the most "valuable" pages , so we altered the login module to not leak this information (note: this was first brought to our attention when a government client had their site failed during a security audit because of this information leakage). We could add a host level setting to allow site admins to use the old behaviour and preserve titles, but I'm not very comfortable with adding settings that allow people to reduce their security.

Cathal

 

---

Buy the new Professional DNN7: Open Source .NET CMS Platform book Amazon US

I agree with this statement, I think a check could be made to see if the module ws actually placed on the tab and NOT to update the title if it is.

---

-Mitchel Sellers
Microsoft MVP, ASPInsider, DNN MVP
CEO/Director of Development - IowaComputerGurus Inc.


Visit mitchelsellers.com for my mostly DNN Blog and support forum.

Visit IowaComputerGurus.com for free DNN Modules, DNN Performance Tips, DNN Consulting Quotes, and DNN Technical Support Services