1810945 - Admin credentials leaked

Status: RESOLVED INVALID

(Tree Management :: Treeherder, defect)

Description

[khageshwarjoshi03]

Attachment: Screenshot (1171).png

User Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:108.0) Gecko/20100101 Firefox/108.0

Steps to reproduce:

• Visit the Url: https://hg.mozilla.org/automation/orangefactor/file/tip/woo_cron.conf.example
• See the credentials

Actual results:

Very sensitive information exposed to the anyone can abuse leads to serious problem to the company

Expected results:

Remove the credential completely or restrict the user to access it

Comment 1

[:Gijs (he/him)]

This software is no longer in use, afaict (last commit 2018), the "example" in the name is not an accident, the api key is left blank, and the password is "MyPassword". I really hope that's not the actual password of anything of importance. Our mercurial code is public by default - we build open source software! - and that is intentional. This isn't a bug.