[Bug 491794] New: webyast should not expose password
http://bugzilla.novell.com/show_bug.cgi?id=491794 Summary: webyast should not expose password Classification: openSUSE Product: openSUSE 11.1 Version: Final Platform: Other OS/Version: Other Status: NEW Severity: Normal Priority: P5 - None Component: YaST2 AssignedTo: schubi@novell.com ReportedBy: msvec@novell.com QAContact: jsrain@novell.com Found By: --- In case of failure the full password is exposed, at least in the Request Details and Session Dump (see bug 491792 and look for "removed"), maybe in other places as well. We should prevent that, it makes providing debug info complicated (and it's not a wanted behavior anyways). -- Configure bugmail: http://bugzilla.novell.com/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are on the CC list for the bug.
http://bugzilla.novell.com/show_bug.cgi?id=491794 User schubi@novell.com added comment http://bugzilla.novell.com/show_bug.cgi?id=491794#c1 Stefan Schubert <schubi@novell.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Priority|P5 - None |P3 - Medium --- Comment #1 from Stefan Schubert <schubi@novell.com> 2009-04-03 02:48:02 MDT --- Hm, rails has an global flag with which is switched off in at least in the logfiles.: Parameters: {"format"=>"xml", "hash"=>{"login"=>"schubi", "password"=>"[FILTERED]", "remember_me"=>true}, "ac tion"=>"create", "controller"=>"sessions"} That this does not work in error case is new for me. -- Configure bugmail: http://bugzilla.novell.com/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are on the CC list for the bug.
http://bugzilla.novell.com/show_bug.cgi?id=491794 http://bugzilla.novell.com/show_bug.cgi?id=491794#c2 Stefan Schubert <schubi@novell.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Status|NEW |CLOSED Resolution| |FIXED --- Comment #2 from Stefan Schubert <schubi@novell.com> 2009-12-07 14:54:15 UTC --- I have checked again and the password will not be report in the session dump. Tested with GMC. Processing SessionsController#create to xml (for 127.0.0.1 at 2009-12-07 15:50:57) [POST] Parameters: {"format"=>"xml", "hash"=>{"remember_me"=>true, "login"=>"schubi", "password"=>"[FILTERED]"}, "action"=>"create", "controller"=>"sessions"} -- Configure bugmail: http://bugzilla.novell.com/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are on the CC list for the bug.
participants (1)
-
bugzilla_noreply＠novell.com