search

mautic / docker-mautic

Docker Image for Mautic
https://www.mautic.org
377 stars 280 forks source link

Security issue password should be masked in log file #175

Open lapkritinis opened 4 years ago

lapkritinis commented 4 years ago

There is no good reason to log the database password into a log file. The culprit is lines like these:

echo >&2 "Database Password: $MAUTIC_DB_PASSWORD"

Reference doc: https://cheatsheetseries.owasp.org/cheatsheets/Logging_Cheat_Sheet.html#data-to-exclude

--- Want to back this issue? **[Post a bounty on it!](https://app.bountysource.com/issues/93297346-security-issue-password-should-be-masked-in-log-file?utm_campaign=plugin&utm_content=tracker%2F20392502&utm_medium=issues&utm_source=github)** We accept bounties via [Bountysource](https://app.bountysource.com/?utm_campaign=plugin&utm_content=tracker%2F20392502&utm_medium=issues&utm_source=github).
bradjones1 commented 1 year ago

There's also a confusing note about the password above that, saying it should be empty?