Details
-
Type:
Bug
-
Status:
Closed
-
Priority:
P1
-
Resolution: Fixed
-
Fix Version/s: Fiona 1.1.0
-
Component/s: Stability and Reliability
-
Labels:
-
Severity:Critical
-
Version:1.0.2.16619
-
Number of attachments:
Description
If someone creates a debug file / log file package it includes the VPN credentials (username and password) and the boxee username in plain text. The boxee password is hashed but may be reversible.
Affected files:
* guisettings.xml:
* <vpn>(.*)</vpn>
* root-boxee.log
* CBoxeeLoginManager
* CGUIDialogBoxeeLoggingIn
* RequestApplicationsListFromServerTask
This data must not be included in such logfiles since some of this attachments are available public and even for you the users credentials should not be accessible at any point!
Affected files:
* guisettings.xml:
* <vpn>(.*)</vpn>
* root-boxee.log
* CBoxeeLoginManager
* CGUIDialogBoxeeLoggingIn
* RequestApplicationsListFromServerTask
This data must not be included in such logfiles since some of this attachments are available public and even for you the users credentials should not be accessible at any point!
Issue Links
- relates
-
BOXEE-7575
Logs contain personally identifiable information
-