Homestyx hydra
Diffusion hydra 3b1a1ae7e309

[SECURITY] Prevented PhabricatorSetupIssueView from exposing sensitive config…

Description

[SECURITY] Prevented PhabricatorSetupIssueView from exposing sensitive config options.

Summary:
Currently PhabricatorSetupIssueView will show the current values of
configuration options regardless of whether or not they are defined
as hidden options. This means that if the MySQL server stops, Phabricator
will present the MySQL connection credentials to anyone who can access
the Phabricator page.

Test Plan:
Stop the MySQL server for a Phabricator instance. It should display 'hidden'
instead of the MySQL password.

Reviewers: epriestley

Reviewed By: epriestley

CC: aran, Korvin

Differential Revision: https://secure.phabricator.com/D5596

Details

Provenance
James RhodesAuthored on Apr 6 2013, 3:27 AM
epriestleyCommitted on Apr 6 2013, 3:39 AM
sirocylPushed on Oct 16 2024, 5:49 AM
Parents
R1:bbfc8a093715: Fix typo in comment
Branches
Unknown
Tags
Unknown

Event Timeline