bugGNU Wget - Bugs: bug #23094, Password in HTML output for FTP


bug #23094: Password in HTML output for FTP

Submitted by:  Michael Novak <michaelnovak>
Submitted on:  Mon 28 Apr 2008 10:12:38 PM UTC  
Category: Program LogicSeverity: 3 - Normal
Priority: 5 - NormalStatus: Needs Discussion
Privacy: PublicAssigned to: Michael Novak <michaelnovak>
Originator Name: michaelnovakOpen/Closed: Open
Release: NoneOperating System: GNU/Linux
Reproducibility: Every TimeFixed Release: None
Planned Release: 1.15Regression: None
Work Required: NonePatch Included: None

Add a New Comment(Rich Markup)

You are not logged in

Please log in, so followups can be emailed to you.


Sun 11 May 2008 09:40:36 AM UTC, comment #1:

when you type such a command, people can already see your username and password in process listing. there is also the fact ftp itself is plain text so anyone on the network can see it.

the wiki faq already shows secure methods for passing the username and password to wget.

Mike Frysinger <vapier>
Mon 28 Apr 2008 10:12:38 PM UTC, original submission:

When you run the wget command such as 'wget ftp://username:password@domain.com' the resulting html file created for the LIST call shows the password in the file in plain text.

I guess the discussion could be around to either remove the password from the url and have it prompt for the password or leave it in without worrying and allow the user to go back and modify the file if they desire.


Michael Novak <michaelnovak>In charge of this item.


(Note: upload size limit is set to 16384 kB, after insertion of the required escape characters.)

Attach File(s):

No files currently attached


Depends on the following items: None found

Items that depend on this one: None found


Carbon-Copy List
  • -unavailable- added by vapier (Posted a comment)
  • -unavailable- added by michaelnovak (Submitted the item)
  • -unavailable- added by michaelnovak

    Please enter the title of George Orwell's famous dystopian book (it's a date):



    Follow 2 latest changes.

    Date Changed By Updated Field Previous Value => Replaced By
    Mon 28 Apr 2008 10:54:40 PM UTCmichaelnovakAssigned toNone=>michaelnovak
    Mon 28 Apr 2008 10:12:39 PM UTCmichaelnovakCarbon-Copy-=>Added michaelnovak

    Back to the top

    Powered by Savane 3.1-cleanup1