search

HiveMedia / TheHiveRadio

This repository is for The Hive Radio's (https://hiveradio.net) website
Other
0 stars 1 forks source link

Remove sensitive data from error messages in Icecast module for Icebreath #20

Closed KatelynHaworth closed 9 years ago

KatelynHaworth commented 9 years ago

Noticed a little problem today where if the Icecast module fails to contact the server it spits out the error saying so but it includes the FULL url it is trying to use (a.k.a the url including the admin creds)

This is a major security flaw that MUST be resolved before v0.1 comes out, it could open up a massive hole in the system if left unfixed

HunterNyan commented 9 years ago

Got an Example URL to generate the error?

KatelynHaworth commented 9 years ago

Lets say I try going to /icebreath/icecast/stats from the dev env on my laptop, I get the following error because I am getting IP block but it gives the error I am talking about (password and IP redacted)

{
    status: "error",
    error: "Failed to connect to the requested server [http://admin:*******@xxx.xxx.xxx.xxx:8000/admin/stats], got HTTP response code [0]",
    timestamp: 1426217930
}

This error is generated on line 107 in the Icecast module, I think the only option here is to just say there was an error and the HTTP status code.

HunterNyan commented 9 years ago

Just remove [$url]

HunterNyan commented 9 years ago

Also consider internal logging

HunterNyan commented 9 years ago

Fixed for now