search

alextselegidis / easyappointments

:date: Easy!Appointments - Self Hosted Appointment Scheduler
https://easyappointments.org
GNU General Public License v3.0
3.26k stars 1.25k forks source link

security breach #1590

Open Wittemberg opened 2 weeks ago

Wittemberg commented 2 weeks ago

I found a security flaw that I found bizarre.

I simulated losing my password... then I clicked on recover and it gave me an error, as I hadn't configured SMTP... In the error message that appeared on the screen, I had the new password... lol

cashewcodes9 commented 2 weeks ago

I found the same issue and this need to be fixed ASAP as it is related to security breach.

alextselegidis commented 1 week ago

Hello!

Thanks for sharing this.

This will only happen if the DEBUG mode is enabled, which is not related to production installations.

However we should in general avoid this, so I will change the debug output to not include passwords.

Alex Tselegidis, Easy!Appointments Creator
Need a customization? Get a free quote!

cashewcodes9 commented 3 days ago

The app is not in dubug mode and is running with clounron. The smtp mail setup is wrong and password is included in the error. Is there anything I can provide for further debugging? THanks.

rezzorix commented 2 days ago

Just adding to see if I understand this right:

That this scenario plays the following conditions must be met:

Do I understand this right?

edit: @cashewcodes9 I also believe the software is in debug mode by default. You would need to change it after setup.

alextselegidis commented 2 days ago

Hello!

Clarification: the app is not in debug mode by default. This is something you can configure in the root config.php

Alex Tselegidis, Easy!Appointments Creator
Need a customization? Get a free quote!

rezzorix commented 2 days ago

Hello!

Clarification: the app is not in debug mode by default. This is something you can configure in the root config.php

Sorry, yes I just checked my file and the debug was set to true in my config.php.... not sure where it came from, probably better for people to check their config.php if they like I did modified something and then forgot about. I have also checked the latest release, the config-sample.php is definitely not in debug mode.