bugGNU Wget - Bugs: bug #23094, Password in HTML output for FTP

 
 

bug #23094: Password in HTML output for FTP

Submitted by:  Michael Novak <michaelnovak>
Submitted on:  Mon 28 Apr 2008 10:12:38 PM UTC  
 
Category:  Program Logic Severity:  3 - Normal
Priority:  5 - Normal Status:  Needs Discussion
Privacy:  Public Assigned to:  Michael Novak <michaelnovak>
Originator Name:  michaelnovak Open/Closed:  Open
Release:  None Operating System:  GNU/Linux
Reproducibility:  Every Time Fixed Release:  None
Planned Release:  1.15 Regression:  None
Work Required:  None Patch Included:  None

Add a New Comment(Rich Markup)
   

You are not logged in

Please log in, so followups can be emailed to you.

 

Sun 11 May 2008 09:40:36 AM UTC, comment #1:

when you type such a command, people can already see your username and password in process listing. there is also the fact ftp itself is plain text so anyone on the network can see it.

the wiki faq already shows secure methods for passing the username and password to wget.

Mike Frysinger <vapier>
Mon 28 Apr 2008 10:12:38 PM UTC, original submission:

When you run the wget command such as 'wget ftp://username:password@domain.com' the resulting html file created for the LIST call shows the password in the file in plain text.

I guess the discussion could be around to either remove the password from the url and have it prompt for the password or leave it in without worrying and allow the user to go back and modify the file if they desire.

thanks,
mike

Michael Novak <michaelnovak>In charge of this item.

 

(Note: upload size limit is set to 16384 kB, after insertion of the required escape characters.)

Attach Files:
   
   
Comment:
   

No files currently attached

 

Depends on the following items: None found

Items that depend on this one: None found

 

Carbon-Copy List
  • -email is unavailable- added by vapier (Posted a comment)
  • -email is unavailable- added by michaelnovak (Submitted the item)
  • -email is unavailable- added by michaelnovak
  •  

     

     

    Follow 2 latest changes.

    Date Changed by Updated Field Previous Value => Replaced by
    2008-04-28 michaelnovak Assigned toNone => michaelnovak
    2008-04-28 michaelnovak Carbon-Copy- => Added michaelnovak

    Back to the top


    Powered by Savane 3.3