690859 - Tracebacks leak private data

Status: VERIFIED FIXED

(Participation Infrastructure :: Phonebook, defect)

Description

[Dave Dash [:davedash, :dd] (assign all bugs to mbrandt)]

Traceback (most recent call last):

 File "/data/www/mozillians.org/mozillians/vendor/src/django/django/core/handlers/base.py", line 111, in get_response
   response = callback(request, *callback_args, **callback_kwargs)

 File "/data/www/mozillians.org/mozillians/vendor/src/django-session-csrf/session_csrf/__init__.py", line 107, in wrapper
   response = f(request, *args, **kw)

 File "/data/www/mozillians.org/mozillians/apps/users/views.py", line 75, in register
   uniq_id = _save_new_user(request, form)

 File "/data/www/mozillians.org/mozillians/apps/users/views.py", line 177, in _save_new_user
   raise Exception(msg)

Exception: Authentication for new user [[e-mail]] with password intheclearpassword failed

Comment 1

[Dave Dash [:davedash, :dd] (assign all bugs to mbrandt)]

If we wrote the code raising the exception, we should not include the password...

Also, I'm not sure why we would have our app fail because we couldn't log in...

Comment 3

[Dave Dash [:davedash, :dd] (assign all bugs to mbrandt)]

This has been fixed.

Comment 4

[[github robot]]

Commit pushed to https://github.com/mozilla/mozillians

https://github.com/mozilla/mozillians/commit/86cbe26741ead43b2d98d058701c140cddfc483d
Removed sensitive data from exception message, fix bug 690859

Comment 5

[[github robot]]

Commit pushed to https://github.com/mozilla/mozillians

https://github.com/mozilla/mozillians/commit/86cbe26741ead43b2d98d058701c140cddfc483d
Removed sensitive data from exception message, fix bug 690859

Comment 6

[Stephen Donner [:stephend] Not actively reading bugmail]

[qa-] until QA can generate a traceback when failing to login, to verify this case.

Comment 7

[Matt Brandt [:mbrandt]]

Bumping to verified as [qa-].