Bug 1375135

Summary:	cockpit-session debug output is enabled
Product:	Red Hat Enterprise Linux 7	Reporter:	Dominik Perpeet <dperpeet>
Component:	cockpit	Assignee:	Dominik Perpeet <dperpeet>
Status:	CLOSED CURRENTRELEASE	QA Contact:	qe-baseos-daemons
Severity:	unspecified	Docs Contact:
Priority:	unspecified
Version:	7.3	CC:	stefw
Target Milestone:	rc	Keywords:	Extras
Target Release:	---
Hardware:	Unspecified
OS:	Unspecified
Whiteboard:
Fixed In Version:	cockpit-118-2.el7	Doc Type:	If docs needed, set a value
Doc Text:		Story Points:	---
Clone Of:		Environment:
Last Closed:	2016-11-10 09:18:06 UTC	Type:	Bug
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Bug Depends On:
Bug Blocks:	1373583

Description Dominik Perpeet 2016-09-12 09:18:01 UTC

Description of problem:
In cockpit-session, debug info is enabled in version 118. No security essential data should be output this way, but it's still not a good setting to have in a production environment.

Version-Release number of selected component (if applicable):
cockpit-118

How reproducible:
Always

Additional info:
Fixed upstream in https://github.com/cockpit-project/cockpit/commit/d2a659d484fdd3ba647de888681bd07d1d64a276
Also added an integration test to verify this: https://github.com/cockpit-project/cockpit/commit/e961c7571397731a2f8d10a938eb073e8ca4be38

Comment 2 Dominik Perpeet 2016-11-10 09:18:06 UTC

Fixed in a patch, cockpit-118-2

Comment 3 Stef Walter 2016-11-10 09:23:53 UTC

In addition upstream now tests for this case, and fails integration tests if we see such output.

https://github.com/cockpit-project/cockpit/pull/4996