[security issue] app.ini stores smtp auth info in plaintext #4765

New Issue

GiteaMirror · 2025-11-02T06:02:14-06:00

GiteaMirror commented

2025-11-02 06:02:14 -06:00

Originally created by @andrewzah on GitHub (Jan 31, 2020).

The app.ini stores the mailer info like:

[mailer]
ENABLED = true
HOST    =
FROM    =
USER    =
PASSWD  =

This is a security issue. Is it not possible to load environment variables in the app.ini?

Originally created by @andrewzah on GitHub (Jan 31, 2020). The `app.ini` stores the mailer info like: ``` [mailer] ENABLED = true HOST = FROM = USER = PASSWD = ``` This is a security issue. Is it not possible to load environment variables in the app.ini?

GiteaMirror added the issue/not-a-bug label 2025-11-02 06:02:14 -06:00

GiteaMirror closed this issue

2025-11-02 06:02:14 -06:00

GiteaMirror commented

2025-11-02 06:02:15 -06:00

@ykcab commented on GitHub (Jan 31, 2020):

@azah is there an application that you have seen which uses a config file with encrypted secrets?
Please do enlight if there is one. Even if you load it via an environment variable, it will still leaven in the same server regardless.

Maybe we want to propose to load all these secrets at initial /install and have them saved in MySQL?

@ykcab commented on GitHub (Jan 31, 2020): @azah is there an application that you have seen which uses a config file with encrypted secrets? Please do enlight if there is one. Even if you load it via an environment variable, it will still leaven in the same server regardless. Maybe we want to propose to load all these secrets at initial /install and have them saved in MySQL?

GiteaMirror commented

2025-11-02 06:02:15 -06:00

@techknowlogick commented on GitHub (Jan 31, 2020):

This is not a security issue as it is assumed that you have the configuration protected appropriately as the DB credentials are also stored there. Environment variables would also need to be protected in a similar fashion.

Closing this issue.

@techknowlogick commented on GitHub (Jan 31, 2020): This is not a security issue as it is assumed that you have the configuration protected appropriately as the DB credentials are also stored there. Environment variables would also need to be protected in a similar fashion. Closing this issue.

GiteaMirror referenced this issue

2025-11-02 13:39:03 -06:00

[PR #4774] [CLOSED] API /admin/users/{username} missing parameter #17491

GiteaMirror referenced this issue

2025-11-02 13:39:11 -06:00

[PR #4775] [MERGED] API /admin/users/{username} missing parameter #17492

Sign in to join this conversation.