Email report sends plain search user password

[Fe3lApAcUt]

Hey

When I received report mails today, it contained the plain ldap search user password. My suggestion is to remove the password completely or replace it with a placeholder.

BR Marcel

[philbertphotos]

Wait WHAT.... its never designed to do that! Let me look at this QUICK!

[Fe3lApAcUt]

I'll leave you a screenshot. I received this mail as an administrator when I searched for a user in the the user management

[Fe3lApAcUt]

I think this mail is only sent when debug logs are activated.

[Fe3lApAcUt]

the password is also visible in the DB (xx_config)

[philbertphotos]

I correcting that bug and also encrypting the password in a future release.

[philbertphotos]

@Fe3lApAcUt are you saying it sent you an email while searching a user name? Or included when sending a report? Is it something that repeats each time you do it?

[Fe3lApAcUt]

@philbertphotos it sent me the mails when I started searching for a user. The reports never worked for me.

[philbertphotos]

@Fe3lApAcUt currently testing the new version in my test version than can send emails and will try and duplicate this and then create a patch once I figure out how its happening.

[philbertphotos]

Cant duplicate the email you get with searching for users ... but I am removing any debug code and will do a update. I think it may be verbose debug sending the admin email of some kind of error.

[Fe3lApAcUt]

Yeah, I think its because of debug, too.

[philbertphotos]

Removed debug code should be all good now.