github-starred/gitea
2
0
Fork 0
mirror of https://github.com/go-gitea/gitea.git synced 2026-03-14 20:07:40 -05:00
Code Issues 2.6k Packages Projects Releases 100 Wiki Activity

SessionProvider MySQL credentials are shown in the admin GUI as plaintext #3437

New Issue
Closed
opened 2025-11-02 05:12:57 -06:00 by GiteaMirror · 5 comments
GiteaMirror commented 2025-11-02 05:12:57 -06:00
Owner
Copy Link

Originally created by @vpr-ossteam on GitHub (Jun 6, 2019).

  • Gitea version (or commit ref): 1.8.1
  • Git version: 2.7.4
  • Operating system: Ubuntu 16.04
  • Database (use [x]):
    • PostgreSQL
    • MySQL
    • MSSQL
    • SQLite
  • Can you reproduce the bug at https://try.gitea.io:
    • Yes (provide example URL)
    • No
    • Not relevant
  • Log gist:

Description

Greetings!
I'm using Gitea 1.8.1 with MySQL 5.7. And if I'm using MySQL for session storing purposes, I can see the credentials in GUI as plaintext.

Steps to reproduce

  1. Select MySQL like a sessions storage in the config file:
[session]
PROVIDER        = mysql
PROVIDER_CONFIG = someclient:somepassword@tcp(srv-mysql:3306)/someclient
  1. Reload Gitea
  2. Login in into Gitea with admin credentials
  3. Follow this way: Site Administration ⇒ Configuration ⇒ Session Configuration ⇒ Provider Config

Screenshots

20190525-152945

Originally created by @vpr-ossteam on GitHub (Jun 6, 2019). <!-- NOTE: If your issue is a security concern, please send an email to security@gitea.io instead of opening a public issue --> <!-- 1. Please speak English, this is the language all maintainers can speak and write. 2. Please ask questions or configuration/deploy problems on our Discord server (https://discord.gg/gitea) or forum (https://discourse.gitea.io). 3. Please take a moment to check that your issue doesn't already exist. 4. Please give all relevant information below for bug reports, because incomplete details will be handled as an invalid report. --> - Gitea version (or commit ref): 1.8.1 - Git version: 2.7.4 - Operating system: Ubuntu 16.04 - Database (use `[x]`): - [ ] PostgreSQL - [x] MySQL - [ ] MSSQL - [ ] SQLite - Can you reproduce the bug at https://try.gitea.io: - [ ] Yes (provide example URL) - [ ] No - [x] Not relevant - Log gist: ## Description Greetings! I'm using Gitea 1.8.1 with MySQL 5.7. And if I'm using MySQL for session storing purposes, I can see the credentials in GUI as plaintext. **Steps to reproduce** 1. Select MySQL like a sessions storage in the config file: ``` [session] PROVIDER = mysql PROVIDER_CONFIG = someclient:somepassword@tcp(srv-mysql:3306)/someclient ``` 2. Reload Gitea 3. Login in into Gitea with admin credentials 4. Follow this way: Site Administration ⇒ Configuration ⇒ Session Configuration ⇒ Provider Config ## Screenshots ![20190525-152945](https://user-images.githubusercontent.com/23170292/59055478-935bfb80-889e-11e9-90d5-6b99fc211fe0.png) <!-- **If this issue involves the Web Interface, please include a screenshot** -->
GiteaMirror added the topic/security label 2025-11-02 05:12:57 -06:00
GiteaMirror commented 2025-11-02 05:12:57 -06:00
Author
Owner
Copy Link

@markkrj commented on GitHub (Nov 21, 2019):

I still can see the password. I'm on version 1.10.0.
image

Edit: Tested same config with 1.9.0 and also shows unmasked password.

@markkrj commented on GitHub (Nov 21, 2019): I still can see the password. I'm on version 1.10.0. ![image](https://user-images.githubusercontent.com/13537652/69361304-f5e95e00-0c6a-11ea-86bc-71979a2969ef.png) Edit: Tested same config with 1.9.0 and also shows unmasked password.
GiteaMirror commented 2025-11-02 05:12:58 -06:00
Author
Owner
Copy Link

@zeripath commented on GitHub (Nov 22, 2019):

This was reFixed in #9002 and #8984

@zeripath commented on GitHub (Nov 22, 2019): This was reFixed in #9002 and #8984
GiteaMirror commented 2025-11-02 05:12:58 -06:00
Author
Owner
Copy Link

@markkrj commented on GitHub (Nov 22, 2019):

@zeripath Well, now it shows nothing:
image
Running 1.10.0+10-gade5ec5aa

But still better than showing credentials.

@markkrj commented on GitHub (Nov 22, 2019): @zeripath Well, now it shows nothing: ![image](https://user-images.githubusercontent.com/13537652/69434813-238edf80-0d1d-11ea-8f18-d009c5e7b4ce.png) Running 1.10.0+10-gade5ec5aa But still better than showing credentials.
GiteaMirror commented 2025-11-02 05:12:58 -06:00
Author
Owner
Copy Link

@zeripath commented on GitHub (Nov 22, 2019):

Do you have/get any logs?

@zeripath commented on GitHub (Nov 22, 2019): Do you have/get any logs?
GiteaMirror commented 2025-11-02 05:12:58 -06:00
Author
Owner
Copy Link

@markkrj commented on GitHub (Nov 22, 2019):

No errors or strange logs in console, just usual router logs... I have the default gitea.log. Tell me if you need more.

@markkrj commented on GitHub (Nov 22, 2019): No errors or strange logs in console, just usual router logs... I have the default [gitea.log](https://github.com/go-gitea/gitea/files/3880752/gitea.log). Tell me if you need more.
Sign in to join this conversation.
No Branch/Tag Specified
Branches Tags
Labels
Clear labels
$20
$250
$50
$500
backport/done
💎 Bounty
docs-update-needed
good first issue
hacktoberfest
issue/bounty
issue/confirmed
issue/critical
issue/duplicate
issue/needs-feedback
issue/not-a-bug
issue/regression
issue/stale
issue/workaround
lgtm/need 2
modifies/api
modifies/translation
outdated/backport/v1.18
outdated/theme/markdown
outdated/theme/timetracker
performance/bigrepo
performance/cpu
performance/memory
performance/speed
pr/breaking
proposal/accepted
proposal/rejected
pr/wip
pull-request
Mirrored from GitHub Pull Request
 reviewed/wontfix
💰 Rewarded
skip-changelog
status/blocked
topic/accessibility
topic/api
topic/authentication
topic/build
topic/code-linting
topic/commit-signing
topic/content-rendering
topic/deployment
topic/distribution
topic/federation
topic/gitea-actions
topic/issues
topic/lfs
topic/mobile
topic/moderation
topic/packages
topic/pr
topic/projects
topic/repo
topic/repo-migration
topic/security
topic/theme
topic/ui
topic/ui-interaction
topic/ux
topic/webhooks
topic/wiki
type/bug
type/deprecation
type/docs
type/enhancement
type/feature
type/miscellaneous
type/proposal
type/question
type/refactoring
type/summary
type/testing
type/upstream
No Label topic/security
Milestone
No items
No Milestone
Projects
Clear projects
No project
Assignees
Clear assignees
GiteaMirror ninjasurge
No Assignees
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: github-starred/gitea#3437
Delete Branch "%!s()"

Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?