release.properties file containing scm credentials in plain text is visible through the Web UI

Details

  • Type: Improvement Improvement
  • Status: Closed Closed
  • Priority: Minor Minor
  • Resolution: Fixed
  • Affects Version/s: 1.1
  • Fix Version/s: 1.2
  • Component/s: Web - UI
  • Labels:
    None
  • Complexity:
    Intermediate
  • Patch Submitted:
    Yes

Description

This is definitely a security hole. As a quickfix, the release.properties file can be hidden in the web ui until a more elegant solution in maven release is done.

Issue Links

relates to

Improvement - An improvement or enhancement to an existing feature or task. CONTINUUM-2202 Do not show subversion password in plain text

  • Major - Major loss of function.
  • Open - The issue is open and ready for the assignee to start work on it.

Improvement - An improvement or enhancement to an existing feature or task. MRELEASE-340 Don't store the scm password in plaintext in release.properties

  • Minor - Minor loss of function, or other problem where easy workaround is present.
  • Closed - The issue is considered finished, the resolution is correct. Issues which are not closed can be reopened.

Activity

Ascending order - Click to sort in descending order
Hide
Permalink
Nap Ramirez added a comment -

The quickfix intercepts requests and throws an exception when release.properties is accessed. The file listing doesn't display the release.properties file as well.

Show
Nap Ramirez added a comment - The quickfix intercepts requests and throws an exception when release.properties is accessed. The file listing doesn't display the release.properties file as well.
Hide
Permalink
Olivier Lamy added a comment -

fixed in rev 663748.
Thanks!

Show
Olivier Lamy added a comment - fixed in rev 663748. Thanks!

People

  • Assignee:
    Olivier Lamy
    Reporter:
    Nap Ramirez
Vote (0)
Watch (0)

Dates

  • Created:
    Updated:
    Resolved: