HomePhorge

[SECURITY] Prevented PhabricatorSetupIssueView from exposing sensitive config…

Description

[SECURITY] Prevented PhabricatorSetupIssueView from exposing sensitive config options.

Summary:
Currently PhabricatorSetupIssueView will show the current values of
configuration options regardless of whether or not they are defined
as hidden options. This means that if the MySQL server stops, Phabricator
will present the MySQL connection credentials to anyone who can access
the Phabricator page.

Test Plan:
Stop the MySQL server for a Phabricator instance. It should display 'hidden'
instead of the MySQL password.

Reviewers: epriestley

Reviewed By: epriestley

CC: aran, Korvin

Differential Revision: https://secure.phabricator.com/D5596

Details

Provenance
James RhodesAuthored on Apr 6 2013, 12:27 AM
epriestleyCommitted on Apr 6 2013, 12:39 AM
themackabuPushed on Mar 25 2025, 8:07 PM
Parents
rPbbfc8a093715: Fix typo in comment
Branches
Unknown
Tags
Unknown

Event Timeline