Mailing-List: contact issues-help@continuum.apache.org; run by ezmlm
Precedence: bulk
Reply-To: dev@continuum.apache.org
Received-SPF: pass (athena.apache.org: local policy)
Message-ID: 
 <13106549.115241248570110930.JavaMail.haus-jira@codehaus01.managed.contegix.com>
Date: Sat, 25 Jul 2009 20:01:50 -0500 (CDT)
From: "Brett Porter (JIRA)" <jira@codehaus.org>
To: issues@continuum.apache.org
Subject: [jira] Commented: (CONTINUUM-2314) Password is printed in logs in
 clear text when adding a project fails
In-Reply-To: 
 <10251042.114551248547070970.JavaMail.haus-jira@codehaus01.managed.contegix.com>
MIME-Version: 1.0
Content-Type: text/plain; charset=ISO-8859-1
Content-Transfer-Encoding: 7bit


    [ http://jira.codehaus.org/browse/CONTINUUM-2314?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=184886#action_184886 ] 

Brett Porter commented on CONTINUUM-2314:
-----------------------------------------

so it is only shown if it is wrong?

> Password is printed in logs in clear text when adding a project fails
> ---------------------------------------------------------------------
>
>                 Key: CONTINUUM-2314
>                 URL: http://jira.codehaus.org/browse/CONTINUUM-2314
>             Project: Continuum
>          Issue Type: Bug
>          Components: Security
>    Affects Versions: 1.3.3
>            Reporter: Carlos Sanchez
>            Priority: Blocker
>             Fix For: 1.3.4
>
>
> I got this in the continuum log, I've changed the parameters to hide the info, but where I say PASSWORDINCLEARTEXT it had my password there 
> Actually it had a bad password with a typo (that's why I got unauthorized) but it was close enough to the real one
> 2009-07-24 16:03:54,137 [addMavenTwoProjectBackgroundThread] INFO  org.apache.maven.continuum.project.builder.maven.MavenTwoContinuumProjectBuilder  - Downloading https://myusername:*****@svn.company.com/repos/pom.xml
> 2009-07-24 16:03:55,392 [addMavenTwoProjectBackgroundThread] ERROR org.apache.maven.continuum.project.builder.maven.MavenTwoContinuumProjectBuilder  - Error
>  adding project: Unauthorized https://myusername:PASSWORDINCLEARTEXT@svn.company.com/repos/pom.xml

-- 
This message is automatically generated by JIRA.
-
If you think it was sent incorrectly contact one of the administrators: http://jira.codehaus.org/secure/Administrators.jspa
-
For more information on JIRA, see: http://www.atlassian.com/software/jira