[#QB-3241] The contents of a password field is displayed as plain text during a REST access to a building.

QuickBuild

The contents of a password field is displayed as plain text during a REST access to a building.

Created: 27/Aug/18 06:56 AM Updated: 18/Sep/18 03:12 PM

Component/s:

None

Affects Version/s:

8.0.8

Fix Version/s:

8.0.20

Original Estimate:

Unknown

Remaining Estimate:

Unknown

Time Spent:

Unknown

Description

« Hide

If I access a building via REST, for example http://QuickBuildServer:8810/rest/builds/76539, the value of a password field is displayed as plain text.

<entry>
    <string>Password</string>
    <com.pmease.quickbuild.SecretAwareString>
       <string>VisiblePassword</string>
       <masked>*****</masked>
   </com.pmease.quickbuild.SecretAwareString>
</entry>

All

Comments

Work Log

Change History

Sort Order:

[ Permlink | « Hide ]

Robin Shen [28/Aug/18 01:44 PM]

The clear text secrets are only available to administrators (in case they need the secret to do something). For other users without administrative rights, they will be removed.

Change by Robin Shen [28/Aug/18 01:44 PM]
Field	Original Value	New Value
Status	Open [ 1 ]	Closed [ 6 ]
Resolution		Won't Fix [ 2 ]

Change by Robin Shen [05/Sep/18 10:30 PM]
Resolution	Won't Fix [ 2 ]
Status	Closed [ 6 ]	Reopened [ 4 ]

Change by Steve Luo [18/Sep/18 03:12 PM]
Status	Reopened [ 4 ]	Resolved [ 5 ]
Assignee	Robin Shen [ robinshine ]
Resolution		Fixed [ 1 ]

Change by Steve Luo [18/Sep/18 03:12 PM]
Fix Version/s		8.0.20 [ 11822 ]