[
https://issues.apache.org/jira/browse/CLOUDSTACK-5355?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=13838407#comment-13838407
]
ASF subversion and git services commented on CLOUDSTACK-5355:
-------------------------------------------------------------
Commit 8367a8fae19bb883747a8fecfa3b00d022513104 in branch refs/heads/4.3 from
[~minchen07]
[ https://git-wip-us.apache.org/repos/asf?p=cloudstack.git;h=8367a8f ]
CLOUDSTACK-5355: addImageStore should not log password in clear text in
the log.
> addImageStore should not log password in clear text in the log
> --------------------------------------------------------------
>
> Key: CLOUDSTACK-5355
> URL: https://issues.apache.org/jira/browse/CLOUDSTACK-5355
> Project: CloudStack
> Issue Type: Bug
> Security Level: Public(Anyone can view this level - this is the
> default.)
> Components: API
> Affects Versions: 4.2.0
> Reporter: Min Chen
> Assignee: Min Chen
> Priority: Critical
> Fix For: 4.3.0
>
>
> For cifs, addImageStore are currently logging everything including username,
> password and domain in clear text in the logs, which are specified in query
> parameter url for the image store.
> Here's an extract from the logs: (obscured actual pwd)
> 2013-11-26 12:03:35,703 DEBUG [c.c.a.ApiServlet]
> (catalina-exec-13:ctx-f0723f52) ===START=== 10.104.255.45 – GET
> command=addImageStore&response=json&sessionkey=5DGP7gv1vXNaK35rAxfIEi7256o%3D&name=SS1&provider=SMB&zoneid=5a60af2b-3025-4f2a-9ecc-8e33bf2b94e3&url=cifs%3A%2F%2F10.102.192.150%2FSMB-Share%2Fsowmya%2Fsecondary%3Fuser%3Dsowmya%26password%3DXXXXX%40123%26domain%3DBLR&_=1385447356899
> 2013-11-26 12:03:35,741 INFO [o.a.c.s.d.l.CloudStackImageStoreLifeCycleImpl]
> (catalina-exec-13:ctx-f0723f52 ctx-547cfc1f) Trying to add a new data store
> at
> cifs://10.102.192.150/SMB-Share/sowmya/secondary?user=sowmya&password=XXX@123&domain=BLR
> to data center 1
> 2013-11-26 12:03:35,776 DEBUG [c.c.u.UriUtils] (catalina-exec-13:ctx-f0723f52
> ctx-547cfc1f) foundUser istrue
> 2013-11-26 12:03:35,777 DEBUG [c.c.u.UriUtils] (catalina-exec-13:ctx-f0723f52
> ctx-547cfc1f) foundPswd istrue
> 2013-11-26 12:03:36,011 DEBUG [c.c.a.ApiServlet]
> (catalina-exec-13:ctx-f0723f52 ctx-547cfc1f) ===END=== 10.104.255.45 – GET
> command=addImageStore&response=json&sessionkey=5DGP7gv1vXNaK35rAxfIEi7256o%3D&name=SS1&provider=SMB&zoneid=5a60af2b-3025-4f2a-9ecc-8e33bf2b94e3&url=cifs%3A%2F%2F10.102.192.150%2FSMB-Share%2Fsowmya%2Fsecondary%3Fuser%3Dsowmya%26password%3DXXX%40123%26domain%3DBLR&_=1385447356899
--
This message was sent by Atlassian JIRA
(v6.1#6144)
