Planned Login-Screen-Change for 17.5 final?

Thank you for the explanation as to why the screen takes a while to load.

Ian

rfcat_vk said:

Thank you for the explanation as to why the screen takes a while to load. 

Furthermore, it seems that a whole Jquery v2.1.3 is exposed via Webadmin. In past there existed some CVE, relating to specific Versions of JQuery. So far for that Version there is no known CVE. But this is one more point where Attacker's Surface is unnecessarily increased.

rfcat_vk said:

Thank you for the explanation as to why the screen takes a while to load. 

Furthermore, it seems that a whole Jquery v2.1.3 is exposed via Webadmin. In past there existed some CVE, relating to specific Versions of JQuery. So far for that Version there is no known CVE. But this is one more point where Attacker's Surface is unnecessarily increased.

Hi Huber,

I believe the issue is already reported as a False Positive .

https://sophos.com/kb/132741

That article does nothing to explain how the vulnerability was fixed. Our PCI compliance scanning company will not accept that article and is still failing us on PCI compliance. They're scanning tools still see 2.1.3 and they said it needs to be 3.0 .0 or higher. Since your article provides no information about how the vunerability was patched they cannot give us a exception.

Not only that but as mentioned why does such a simple login page take over 2 megabytes of data transfers.

AllanD said:

 

Unknown said:

 

At present, Login Page asset size is 693 kb (screen shot below). We currently load various micro functionalities of JS files into a single large JS file. Not all of the functionalities are being used by login screen and there is a scope for optimization.

Appreciate your feedback and concern - we will consider this optimization in the future version.