jce
jce copied to clipboard
Joomla password is saved in clear text as "updates_key"
Describe the bug
- Joomla 4.0.5.
- JCE 2.9.18 FREE and earlier
- Firefox 95.0.2 (64-Bit) on Win10
- Save your Joomla credentials in Firefox after login in Joomla backend (FF asks if I want to save them).
- If you have saved just 1(!) login credential for the Joomla domain.
- Go to JCE > Control Panel > Options
- The field Update Options > Update Key is prefilled by FireFox with the password of the currently logged in Joomla user.
- If you save then the JCE options the password is saved in the database unhashed. Field
params
of#__extension
COM_JCE
. - And other users can see it afterwards by clicking on the eye button.
- Users of FREE JCE version seldomly look into the "Update Options" to clear the field before saving.
Screenshots
Additional context Question: If this is not solveable from your side: Is it a problem to enter a dummy key in that field or will I get then warnings or something on updates?
Thank you!