search

QuantumEntangledAndy / neolink

An RTSP bridge to Reolink IP cameras
GNU Affero General Public License v3.0
247 stars 39 forks source link

Full Config with *unobscured* passwords is stored in MQTT broker #238

Open morrisb74 opened 2 months ago

morrisb74 commented 2 months ago

Describe the bug A full config is dropped in the MQTT broker under /neolink/config which shows unobscured passwords!

To Reproduce Steps to reproduce the behavior. Example:

  1. Create this configuration file: Any config with MQTT enabled
  2. Launch Neolink:
  3. Open a MQTT Explorer/Client and lookup /neolink/config

Expected behavior Not to find a config file in the MQTT broker, or at least with the passwords obscured.

Versions NVR software: N/A Neolink software: 0.6.3.rc.2 Reolink camera model and firmware: N/A

QuantumEntangledAndy commented 2 months ago

Yeah I know I keep meaning to fix this but other things keep comming up. You can make a PR if you have the time

QuantumEntangledAndy commented 2 months ago

Currently that config is watched so any changes in it are used to update the live camera. So you can add and remove cameras using it. It is run though the same de-serialization as the on disk config code and would need some sort of middle man to strip and add the passwords inbetween the deserialisation and serialisation