Skip to content

Commit

Permalink
Item11746: Warn that the EMAIL Debug log exposes passwords
Browse files Browse the repository at this point in the history
I didn't realize that the "encrypted" login exchange was actually just
base64 encoded and easily reversed.

Yes I know,  it's a change post RC,  but this is important

George

git-svn-id: http://svn.foswiki.org/branches/Release01x01@16136 0b4bb1d4-4e5a-0410-9cc4-b2b747904278
  • Loading branch information
GeorgeClark authored and GeorgeClark committed Nov 30, 2012
1 parent 1053bcf commit fa6f5bf
Showing 1 changed file with 4 additions and 0 deletions.
4 changes: 4 additions & 0 deletions core/lib/Foswiki/Configure/templates/testemailintro.tmpl
Original file line number Diff line number Diff line change
Expand Up @@ -15,6 +15,10 @@
</p>
</div>
<div class='foswikiNotification'>
<div class='foswikiAlert'>
<br /><strong>Caution: The test log will expose email usernames and passwords.</strong> They are not encrypted or obfuscated, and can be recovered from this log! Be careful if posting this log for debugging assistance!
Especially the lines after the <code>SMTP auth: Attempting authentication</code>. They are <strong>not encrypted</strong>, but are reversably encoded.
</div>
<p>
This action will temporarily enable email along with the email debugging flag and will attempt to send an email to the admin email address. Errors will be reported back to the web interface instead of to the server logs.
</p>
Expand Down

0 comments on commit fa6f5bf

Please sign in to comment.