Bug #34573
closed
Settings defined by DSL are not properly encrypted
Added by Ondřej Ezr almost 3 years ago.
Updated almost 3 years ago.
Description
The values set for the DSL defined settings are not properly encrypted.
This is caused by the encrypted flag not being propagated for newly created settings and thus only new Foreman instances are affected.
How to reproduce:
1. Remove contents of settings table
2. Start foreman
3. Set a encrypted setting e.g. root_pass to any value
4. See the value in database for this setting. (possibly also from console by `Setting.find_by(name: 'root_pass').read_attribute(:value)`
Files
- Target version set to 3.1.3
- Found in Releases 3.1.3 added
- Related to Feature #30862: Introduce SettingRegistry as a setting inventory added
- Description updated (diff)
- Found in Releases 3.1.0 added
- Found in Releases deleted (
3.1.3)
How to reproduce:
1. Remove contents of settings table
2. Start foreman
3. Set a encrypted setting e.g. root_pass to any value
4. See the value in database for this setting. (possibly also from console by `Setting.find_by(name: 'root_pass').read_attribute(:value)`
- Description updated (diff)
- Private changed from Yes to No
As discussed, this can be disclosed.
- Status changed from New to Ready For Testing
- Assignee set to Ondřej Ezr
- Pull request https://github.com/theforeman/foreman/pull/9139 added
- Bugzilla link set to 2061773
- Fixed in Releases 3.3.0 added
- Status changed from Ready For Testing to Closed
- Fixed in Releases 3.1.3, 3.2.0 added
Also available in: Atom
PDF