749906 - bzexport documentation recommends the user to send their bugzilla password over HTTP instead of HTTPS

Status: RESOLVED FIXED

(Developer Services :: Mercurial: bzexport, defect)

Description

[Brian Smith (:briansmith, :bsmith, use NEEDINFO?)]

See http://hg.mozilla.org/users/tmielczarek_mozilla.com/bzexport/file/a8ebbe6e3ddc/README:

    # URL to the Bugzilla server to use. The default is
    # https://bugzilla.mozilla.org.
    bugzilla = http://bugzilla.example.com/

    # URL to the BzAPI server to use. The default is
    # https://api-dev.bugzilla.mozilla.org/latest/
    api_server = http://bzapi.example.com/latest/

I recommend that this be replaced with:

    # URL to the Bugzilla server to use. The default is
    # bugzilla = https://bugzilla.mozilla.org.

    # URL to the BzAPI server to use. The default is
    # api_server = https://api-dev.bugzilla.mozilla.org/latest/

to avoid peole revealing their passwords via absentminded copy/paste.

Comment 1

[(not currently active) Ted Mielczarek]

Feel free to just push a change to it.

Comment 2

[Steve Fink [:sfink] [:s:]]

http://hg.mozilla.org/users/tmielczarek_mozilla.com/bzexport/rev/b49697ac9ab7