GET request for password validation in user registration integration

I've enabled the user Registration Integration in the settings. During a PCI compliance scan, it noticed that the password field validation was using an ajax GET request. While it's encrypted with https, since it's a GET request, the password parameter could be logged in the log files.

I could have missed it, but I don't see a way to disable to the password validation in the configuration. The more permanent solution should be to change the password validation to a POST request. Another option is simply to disable the user registration integration, but that's somethiing we'd prefer to have.

Hello Chris

We rely on a validation engine for data validation, so we could not change the request to POST for now. So if you want, you can only disable password validation. Edit the code in the file components/com_osmembership/view/register/tmpl/default_form.php, change this line of code:

to


Please note that one the modification is done, you should move this modified file to PATH_TO_TEMPLATE/html/com_osmembership/register folder so that the change won't be lost when you update

Hope this helps

Tuan

Thanks. That worked.

Great. Thanks for confirming

Tuan