Skip to content

Shadow the password on cache and session config on admin panel #7300

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
merged 4 commits into from
Jun 26, 2019
Merged

Shadow the password on cache and session config on admin panel #7300

Changes from 1 commit
Commits
Show all changes
4 commits
Select commit Hold shift + click to select a range
54ffde4
shadow the password on cache and session config on admin panel
lunny Jun 26, 2019
f3636a7
add shadow password of mysql/postgres/couchbase
lunny Jun 26, 2019
55de1bc
fix log import
lunny Jun 26, 2019
f0f43ca
Merge branch 'master' into lunny/fix_config_security
lunny Jun 26, 2019
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
19 changes: 17 additions & 2 deletions routers/admin/admin.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -202,6 +202,17 @@ func SendTestMail(ctx *context.Context) {
ctx.Redirect(setting.AppSubURL + "/admin/config")
}

func shadowPassword(cfgItem string) string {
fields := strings.Split(cfgItem, ",")
Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I think there need to be more than one check, since the config strings can be different for MySQL and redis. This seems to fix for redis, but not MySQL. In the example from #7147, the session provider connection string is:

someclient:somepassword@tcp(srv-mysql:3306)/someclient

This format uses DSN, so the password is optional: https://github.com/go-sql-driver/mysql

Maybe it you can also pass in the adapter/provider to shadowPassword and then know if it is Redis/MySQL and check based on that.

Copy link
Member Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

OK. Will fix that.

for i := 0; i < len(fields); i++ {
if strings.HasPrefix(fields[i], "password=") {
fields[i] = "password=******"
break
}
}
return strings.Join(fields, ",")
}

// Config show admin config page
func Config(ctx *context.Context) {
ctx.Data["Title"] = ctx.Tr("admin.config")
Expand Down Expand Up @@ -239,10 +250,14 @@ func Config(ctx *context.Context) {

ctx.Data["CacheAdapter"] = setting.CacheService.Adapter
ctx.Data["CacheInterval"] = setting.CacheService.Interval
ctx.Data["CacheConn"] = setting.CacheService.Conn

ctx.Data["CacheConn"] = shadowPassword(setting.CacheService.Conn)
ctx.Data["CacheItemTTL"] = setting.CacheService.TTL

ctx.Data["SessionConfig"] = setting.SessionConfig
sessionCfg := setting.SessionConfig
sessionCfg.ProviderConfig = shadowPassword(sessionCfg.ProviderConfig)

ctx.Data["SessionConfig"] = sessionCfg

ctx.Data["DisableGravatar"] = setting.DisableGravatar
ctx.Data["EnableFederatedAvatar"] = setting.EnableFederatedAvatar
Expand Down