• Do not register here on develop.twiki.org, login with your twiki.org account.
• Use

Item7848 for generic doc work for TWiki-6.1.1. Use

Item7851 for doc work on extensions that are not part of a release. More... Close
• Anything you create or change in standard webs (Main, TWiki, Sandbox etc) will be automatically reverted on every SVN update.
• Does this site look broken?. Use the LitterTray web for test cases.

Item7420: Installer caches credentials in world-readable file

Item Form Data

AppliesTo:	Component:	Priority:	CurrentState:	WaitingFor:	TargetRelease	ReleasedIn
Extension	BuildContrib	Urgent	New		n/a

Detail

When build.pl upload saves password and creates a .buildcontrib file, the file is world read and the credentials are stored in plain text. Obviously, this is a security issue.

It should create the file with user rw, g none w none. required

It would be better to encrypt the file - or at least obscure the credentials with base64 encoding to resist shoulder surfing. recommended

-- TWiki:Main/TimotheLitt - 2014-01-24

ItemTemplate
Summary	Installer caches credentials in world-readable file
ReportedBy	TWiki:Main.TimotheLitt
Codebase
SVN Range	TWiki-6.0.1-trunk, Thu, 09 Jan 2014, build 26720
AppliesTo	Extension
Component	BuildContrib
Priority	Urgent
CurrentState	New
WaitingFor
Checkins
TargetRelease	n/a
ReleasedIn

Raw edit | More topic actions

Topic revision: r1 - 2014-01-24 - TimotheLitt

Account
- Log In

Edit
Attach

Item7420: Installer caches credentials in world-readable file

Item Form Data

Edit Form Data

Detail