View Issue Details
| ID | Project | Category | View Status | Date Submitted | Last Update |
|---|---|---|---|---|---|
| 0003611 | mantisbt | security | public | 2004-02-28 22:59 | 2004-02-29 07:16 |
| Reporter | vboctor | Assigned To | vboctor | ||
| Priority | normal | Severity | minor | Reproducibility | always |
| Status | closed | Resolution | fixed | ||
| Product Version | 0.18.1 | ||||
| Summary | 0003611: Mask passwords when printing details error information | ||||
| Description | When $g_show_detailed_errors = ON, the context of the error includes all variable names and values. If the MySQL server is done, the context in this case shows the password. The print context should be changed to mask any variable name that includes the token 'password'. | ||||
| Tags | No tags attached. | ||||
| Attached Files | 3611.diff (889 bytes)
Index: core/error_api.php
===================================================================
RCS file: /cvsroot/mantisbt/mantisbt/core/error_api.php,v
retrieving revision 1.28
diff -u -r1.28 error_api.php
--- core/error_api.php 11 Jan 2004 07:16:10 -0000 1.28
+++ core/error_api.php 29 Feb 2004 03:56:54 -0000
@@ -176,7 +176,15 @@
# print normal variables
foreach ( $p_context as $t_var => $t_val ) {
if ( !is_array( $t_val ) && !is_object( $t_val ) ) {
- echo "<tr><td>$t_var</td><td>" . htmlentities( (string)$t_val ) . '</td><td>' . gettype( $t_val ) . "</td></tr>\n";
+ $t_val = htmlentities( (string)$t_val );
+ $t_type = gettype( $t_val );
+
+ # Mask Passwords
+ if ( strpos( $t_var, 'password' ) !== false ) {
+ $t_val = '**********';
+ }
+
+ echo "<tr><td>$t_var</td><td>$t_val</td><td>$t_type</td></tr>\n";
}
}
| ||||
