Shadow the password on cache and session config on admin panel #7300
Conversation
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
lunny
added
the
topic/security
sapk
approved these changes
Jun 26, 2019
GiteaBot
added
the
lgtm/need 1
Codecov Report
@@ Coverage Diff @@
## master #7300 +/- ##
==========================================
+ Coverage 41.2% 41.23% +0.03%
==========================================
Files 464 464
Lines 62788 62832 +44
==========================================
+ Hits 25873 25911 +38
- Misses 33524 33529 +5
- Partials 3391 3392 +1
Continue to review full report at Codecov.
|
mrsdizzie
suggested changes
Jun 26, 2019
routers/admin/admin.go
Outdated
| @@ -202,6 +202,17 @@ func SendTestMail(ctx *context.Context) { | |||
| ctx.Redirect(setting.AppSubURL + "/admin/config") | |||
| } | |||
|
|
|||
| func shadowPassword(cfgItem string) string { | |||
| fields := strings.Split(cfgItem, ",") | |||
There was a problem hiding this comment.
I think there need to be more than one check, since the config strings can be different for MySQL and redis. This seems to fix for redis, but not MySQL. In the example from #7147, the session provider connection string is:
someclient:somepassword@tcp(srv-mysql:3306)/someclient
This format uses DSN, so the password is optional: https://github.com/go-sql-driver/mysql
Maybe it you can also pass in the adapter/provider to shadowPassword and then know if it is Redis/MySQL and check based on that.
|
@mrsdizzie done with test. |
mrsdizzie
approved these changes
Jun 26, 2019
GiteaBot
added
lgtm/done
jeffliu27
pushed a commit
to jeffliu27/gitea
that referenced
this pull request
Jul 18, 2019
…tea#7300) * shadow the password on cache and session config on admin panel * add shadow password of mysql/postgres/couchbase * fix log import
zeripath
added a commit
to zeripath/gitea
that referenced
this pull request
Nov 23, 2019
Although go-gitea#7300 properly shadows the password from the virtual session provider, the template displaying the provider config still presumed that the config was JSON. This PR updates the template and properly hides the Virtual Session provider. Fixes go-gitea#7127
techknowlogick
pushed a commit
that referenced
this pull request
Nov 28, 2019
* Properly fix #7127 Although #7300 properly shadows the password from the virtual session provider, the template displaying the provider config still presumed that the config was JSON. This PR updates the template and properly hides the Virtual Session provider. Fixes #7127 * update per @silverwind's suggestion
6543
pushed a commit
to 6543-forks/gitea
that referenced
this pull request
Nov 29, 2019
…itea#9137) * Properly fix go-gitea#7127 Although go-gitea#7300 properly shadows the password from the virtual session provider, the template displaying the provider config still presumed that the config was JSON. This PR updates the template and properly hides the Virtual Session provider. Fixes go-gitea#7127 * update per @silverwind's suggestion
techknowlogick
pushed a commit
that referenced
this pull request
Nov 29, 2019
… (#9203) * Properly fix #7147 Although #7300 properly shadows the password from the virtual session provider, the template displaying the provider config still presumed that the config was JSON. This PR updates the template and properly hides the Virtual Session provider. Fixes #7147 * update per @silverwind's suggestion
Sign up for free
to subscribe to this conversation on GitHub.
Already have an account?
Sign in.
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
will fix #7147