Bug 1375135 - cockpit-session debug output is enabled
Summary: cockpit-session debug output is enabled
Keywords:
Status: CLOSED CURRENTRELEASE
Alias: None
Product: Red Hat Enterprise Linux 7
Classification: Red Hat
Component: cockpit
Version: 7.3
Hardware: Unspecified
OS: Unspecified
unspecified
unspecified
Target Milestone: rc
: ---
Assignee: Dominik Perpeet
QA Contact: qe-baseos-daemons
URL:
Whiteboard:
Depends On:
Blocks: 1373583
TreeView+ depends on / blocked
 
Reported: 2016-09-12 09:18 UTC by Dominik Perpeet
Modified: 2016-11-10 09:23 UTC (History)
1 user (show)

Fixed In Version: cockpit-118-2.el7
Doc Type: If docs needed, set a value
Doc Text:
Clone Of:
Environment:
Last Closed: 2016-11-10 09:18:06 UTC
Target Upstream Version:

Attachments (Terms of Use)
Add an attachment (proposed patch, testcase, etc.)

Description Dominik Perpeet 2016-09-12 09:18:01 UTC 
Description of problem:
In cockpit-session, debug info is enabled in version 118. No security essential data should be output this way, but it's still not a good setting to have in a production environment.

Version-Release number of selected component (if applicable):
cockpit-118

How reproducible:
Always

Additional info:
Fixed upstream in https://github.com/cockpit-project/cockpit/commit/d2a659d484fdd3ba647de888681bd07d1d64a276
Also added an integration test to verify this: https://github.com/cockpit-project/cockpit/commit/e961c7571397731a2f8d10a938eb073e8ca4be38
Comment 2 Dominik Perpeet 2016-11-10 09:18:06 UTC 
Fixed in a patch, cockpit-118-2
Comment 3 Stef Walter 2016-11-10 09:23:53 UTC 
In addition upstream now tests for this case, and fails integration tests if we see such output.

https://github.com/cockpit-project/cockpit/pull/4996
Note You need to log in before you can comment on or make changes to this bug.