Index: openacs-4/packages/acs-subsite/acs-subsite.info =================================================================== RCS file: /usr/local/cvsroot/openacs-4/packages/acs-subsite/acs-subsite.info,v diff -u -r1.131.2.10 -r1.131.2.11 --- openacs-4/packages/acs-subsite/acs-subsite.info 22 Nov 2019 18:41:34 -0000 1.131.2.10 +++ openacs-4/packages/acs-subsite/acs-subsite.info 28 Nov 2019 11:06:31 -0000 1.131.2.11 @@ -9,7 +9,7 @@ t t - + OpenACS Subsite 2017-08-06 @@ -18,11 +18,11 @@ GPL 3 - + - + Index: openacs-4/packages/acs-subsite/lib/user-new.tcl =================================================================== RCS file: /usr/local/cvsroot/openacs-4/packages/acs-subsite/lib/user-new.tcl,v diff -u -r1.23 -r1.23.2.1 --- openacs-4/packages/acs-subsite/lib/user-new.tcl 30 Jun 2018 21:08:42 -0000 1.23 +++ openacs-4/packages/acs-subsite/lib/user-new.tcl 28 Nov 2019 11:06:31 -0000 1.23.2.1 @@ -182,9 +182,16 @@ } -after_submit { if { $next_url ne "" } { - # Add user_id and account_message to the URL - - ad_returnredirect [export_vars -base $next_url {user_id password {account_message $creation_info(account_message)}}] + # + # Add user_id and account_message to the URL, but do not pass + # password via query parameter. We have to make sure that + # $next_url tries to get the password from the client property + # as well. + # + security::set_client_property_password $password + ad_returnredirect [export_vars -base $next_url { + user_id {account_message $creation_info(account_message)} + }] ad_script_abort } Index: openacs-4/packages/acs-tcl/acs-tcl.info =================================================================== RCS file: /usr/local/cvsroot/openacs-4/packages/acs-tcl/acs-tcl.info,v diff -u -r1.95.2.7 -r1.95.2.8 --- openacs-4/packages/acs-tcl/acs-tcl.info 22 Nov 2019 18:41:34 -0000 1.95.2.7 +++ openacs-4/packages/acs-tcl/acs-tcl.info 28 Nov 2019 11:06:31 -0000 1.95.2.8 @@ -9,7 +9,7 @@ f t - + OpenACS The Kernel Tcl API library. 2017-08-06 @@ -18,7 +18,7 @@ GPL version 2 3 - + Index: openacs-4/packages/acs-tcl/tcl/security-procs.tcl =================================================================== RCS file: /usr/local/cvsroot/openacs-4/packages/acs-tcl/tcl/security-procs.tcl,v diff -u -r1.126.2.22 -r1.126.2.23 --- openacs-4/packages/acs-tcl/tcl/security-procs.tcl 16 Nov 2019 15:45:55 -0000 1.126.2.22 +++ openacs-4/packages/acs-tcl/tcl/security-procs.tcl 28 Nov 2019 11:06:31 -0000 1.126.2.23 @@ -1837,8 +1837,25 @@ util_memoize_seed [list sec_lookup_property $session_id $module $name] [list $value $secure] } +ad_proc -public security::set_client_property_password {password} { + + Convenience function for remembering user password as client property + rather than passing it as query parameter. + @see security::get_client_property_password +} { + ad_set_client_property -persistent f acs-admin user-password $password +} +ad_proc -public security::get_client_property_password {password} { + + Convenience function for retrieving user password from client property + @see security::set_client_property_password + +} { + return [ad_get_client_property acs-admin user-password] +} + ##### # # security namespace public procs Index: openacs-4/packages/dotlrn/dotlrn.info =================================================================== RCS file: /usr/local/cvsroot/openacs-4/packages/dotlrn/dotlrn.info,v diff -u -r1.148.2.2 -r1.148.2.3 --- openacs-4/packages/dotlrn/dotlrn.info 17 May 2019 19:28:06 -0000 1.148.2.2 +++ openacs-4/packages/dotlrn/dotlrn.info 28 Nov 2019 11:06:31 -0000 1.148.2.3 @@ -7,17 +7,17 @@ f f - + OpenACS A Course Management System 2017-08-06 DotLRN Consortium 2 Course Management - + - + Index: openacs-4/packages/dotlrn/www/user-add-2.tcl =================================================================== RCS file: /usr/local/cvsroot/openacs-4/packages/dotlrn/www/user-add-2.tcl,v diff -u -r1.18 -r1.18.2.1 --- openacs-4/packages/dotlrn/www/user-add-2.tcl 29 Jun 2018 17:27:19 -0000 1.18 +++ openacs-4/packages/dotlrn/www/user-add-2.tcl 28 Nov 2019 11:06:32 -0000 1.18.2.1 @@ -68,7 +68,12 @@ } } -set redirect [export_vars -base user-add-2 {user_id password referer type can_browse_p read_private_data_p dotlrn_interactive_p add_membership_p}] +if {[info exists password]} { + security::set_client_property_password $password +} +set redirect [export_vars -base user-add-2 { + user_id referer type can_browse_p read_private_data_p dotlrn_interactive_p add_membership_p +}] if { $add_membership_p == "t" && $referer eq "/acs-admin/users" } { set redirect "one-community-admin" } else {