Log in with username/password: lyceum/lyceum

{5} Assigned, Active Tickets by Owner (Full Description) (6 matches)

List tickets assigned, group by ticket owner. This report demonstrates the use of full-row display.

jjb

Ticket Summary Component Milestone Type Severity Created
Description
#87 dashboard should reflect internal RSS Central Portal The Future defect major 10/24/05

per our design. this is a key issue. .7.

please refer to mu installation for guidance.


#86 password protected post view in net news wire Central Portal The Future defect normal 10/24/05

after entering password, get kicked back to portal


#148 rate-limiter and cieling on login screen security The Future defect normal 11/03/05

limit the rate at which the same IP can attempt and fail to log in. also limit the total number of times. (something generous)


#149 one-time password system -- password timeout security Diverges from WordPress enhancement normal 11/03/05

dependent on ticket:235

session token is reset from time to time, if a valid session cookie is present. persistent logins, without having username and password in cookie, and without loosing any security or conveniencce.

see shiflett pp69-73

enhancement to shiflett model: is there any reason to not generate a new token for every request?


adamc:

Off the top of my head, the approach I would favor here is shifting from the passing of Kerberos passwords (even hashed ones, as Mike pointed out; md5 and even sha-1 are falling victim to Moore's law and some sophisticated mathematics) around in cookies, to using one-time session keys. Upon successfully authenticating via Kerberos [ mechanism to be determined =) ], a session key for the user would be created that allows access to whatever the user has privileges to access. Effectively, the session key is a one-off password.

That key would be what's remembered. That way, if the cookie is ever sniffed, the only thing that's lost is something that temporarily allows access to this one resource, rather than the compromise of the user's Onyen account.


#152 case sensitivity for email addresses General The Future defect normal 11/03/05

problem with WP Trunk

Date: Thu, 3 Nov 2005 17:30:41 -0500 (EST) From: jason moore Subject: [Lyceum-bugs] Password Mailing bugs

[snip]

the reset thing doesn't recognize my email with anything in the domain name capitalized that wasn't that way when i input it. I.e. i registered as zulick AT nospam Ibiblio.org but it doesn't recognize zulick AT nospam ibiblio.org or zulick AT nospam iBiblio.org.

jason

-- jason z. moore http://www.badmonkey.org


#804 Trivial script to "probably" detect compatibility of plugins and themes None 1.1 enhancement None 08/17/07

One thing that would be really nice, when shopping around for plugins and themes to use with Lyceum, is a script that could help me guess if the theme/plugin is compatible with Lyceum in addition to WordPress.

There is probably a list of Lyceum-unsafe WordPress functions to reference, and just a trivial bundled script that greps for them would be a huge help. Super rad would be a guide to what to do when you see each kind of Lyceum-unsafe function call.


jjb brainstorming

This tool should check for:

  • table creation
  • anything using $wpdb

Note: See TracReports for help on using and creating reports.
Log in with username/password: lyceum/lyceum