On the topic of clear text authentication, I notice that the browser's local storage (not cookies ahun) has records with :
- key: Database_name``|last_password
- value:PasswordInClearText`
If concerned by security, this could be a potential issue regarding access to openerp from public computers. I doubt an average user would know how to clear local storage after using a public computer for quick access to his platform.
How can we disable this functionality to get back to normal authentication / session expiry scheme ?
(or am I missing something ??)
Bump ! This is a potential major issue imho..
After reading last initOS comment, I realised this could be a vulnerability and decided to report a security bug in lauchpad (private for now). I will post feedback here. Thank you.