Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Avoid exposing the Postgres credentials #628

Merged
merged 1 commit into from
May 2, 2023

Conversation

sbivol
Copy link
Contributor

@sbivol sbivol commented May 1, 2023

Quetz prints the database connection string on startup. This is unnecessary and potentially insecure, since the person reading Quetz logs is not necessarily authorized to manage Quetz.
This patch replaces the connection string with just the name of the database engine: SQLite, PostgreSQL, or whatever happens to be preceding the first slash (useful in case the user made a typo, or other DB engines become supported in the future).

@codecov-commenter
Copy link

codecov-commenter commented May 2, 2023

Codecov Report

Patch coverage: 77.77% and project coverage change: -1.00 ⚠️

Comparison is base (1f29a9c) 82.28% compared to head (ce5a6e6) 81.28%.

📣 This organization is not using Codecov’s GitHub App Integration. We recommend you install it so Codecov can continue to function properly for your repositories. Learn more

Additional details and impacted files
@@            Coverage Diff             @@
##             main     #628      +/-   ##
==========================================
- Coverage   82.28%   81.28%   -1.00%     
==========================================
  Files          78       78              
  Lines        6124     6130       +6     
==========================================
- Hits         5039     4983      -56     
- Misses       1085     1147      +62     
Impacted Files Coverage Δ
quetz/cli.py 74.68% <77.77%> (-0.16%) ⬇️

... and 3 files with indirect coverage changes

☔ View full report in Codecov by Sentry.
📢 Do you have feedback about the report comment? Let us know in this issue.

@wolfv wolfv added the enhancement New feature or request label May 2, 2023
@wolfv
Copy link
Member

wolfv commented May 2, 2023

Thanks!

@wolfv wolfv merged commit 738ac2d into mamba-org:main May 2, 2023
@sbivol sbivol deleted the fix/db-secrets-leak branch May 2, 2023 10:06
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
enhancement New feature or request
Projects
None yet
Development

Successfully merging this pull request may close these issues.

3 participants