13061 - Security risk: bugzilla passwords show up in stdout

Status: VERIFIED FIXED

(SeaMonkey :: General, defect, P3)

Description

[Claudius Gayle]

t
h
i
s

i
s

a

t
e
s
t

Comment 1

[(not reading, please use [e-mail] instead)]

marking m11.

cc'ing davidm and morse.  they should know more about this than I do.


I've see this before though.  as I type my mail news password, the characters
show up in the console.

Comment 2

[(not reading, please use [e-mail] instead)]

checked in a "fix".

I don't see the "one character per line" behaviour, but I do see the
"mPassword text is XXXXX" behaviour, which is scary too.

jfrancis and buster:  I just checked in a change to
mozilla/editor/base/nsTextEditRules.cpp
so that the code that prints out "mPassword text is XXXXX" is wrapped with
#ifdef DEBUG_jfrancis and #ifdef DEBUG_buster, depending on who wrote the code.

marking fixed.

Comment 3

[Claudius Gayle]

the one character per line thing has nothing to do with this bug really.
That was some wierd text field widget thing. I still see a problem with the
1999090708 Linux build. If I go to the Bugzilla main page and select 'forget
current login' and then 'change password' I'm presented with the standard bugzilla
login page. If I type in my name and password and click 'Login' the following is
printed to the console.
Bugzilla_login=claudius%40netscape.com&Bugzilla_password=XXXXXX&GoAheadAndLogin=
login

where of course XXXXXX is my password in clear text.

Comment 4

[(not reading, please use [e-mail] instead)]

claudius, the problem that you describe is caused by someone in the code doing a
printf of the url, probably for some debugging reason.

I'll try to hunt it down and wrap it with some #ifdef DEBUG_<author> lines.

accepting.

Comment 5

[leger]

Clearing Fixed resolution due to reopen.

Comment 6

[Phil Peterson]

Move milestone stoppers to M10

Comment 7

[(not reading, please use [e-mail] instead)]

I don't think this is still happening.  marking works for me.

Comment 8

[Claudius Gayle]

still happens exactly as I stated in my comments from 09/07 which seems
different from what you fixed prior to that.

Comment 9

[(not reading, please use [e-mail] instead)]

moving to m12.

Comment 10

[leger]

Clearing WORKSFORME resolution due to Reopen.

Comment 11

[Phil Peterson]

Seems like we're not talking about mail/news passwords here; reassigning to don.

Comment 12

[don]

Move to M13.

Comment 13

[Chris McAfee]

Isn't this a generic dialog problem?
danm.  Reassign to me if you're swamped, I can look at this too.

Comment 14

[Dan M]

When I follow Claudius' instructions from 09/07/99, I see form submission debug output,
not generic dialog output. Reassigning for consideration to karnaze, who owns the printfs
in question (DebugPrint and its use in nsFormFrame::OnSubmit).

Comment 15

[karnaze (gone)]

Reassigning to Kevin.

Comment 16

[Kevin McCluskey (gone)]

Fixed in 1/6/2000 2:07PM build. I commented out the lines that where printing
the contents of form elements when the form was submitted.

Comment 17

[Claudius Gayle]

VERIFIED fixed with 20000111 builds