Description of problem: After invoking a Configure Cloud Connector job, Receptor user credentials are shown in Job Invocation's "User Inputs" part which is accessible to any user with "Remote Execution User" role. This user can login as Receptor user, misusing whatever rights that user has. Similar to bug 1814998. Version-Release number of selected component (if applicable): Sat 6.7 snap 17, NOT regression How reproducible: Deterministic Steps to Reproduce: 1. Hosts -> Job Templates -> run Configure Cloud Connector 2. Select hosts, enter (required) satellite_user and satellite_password 3. As any user that can do it, open the job invocation Actual results: You can see satellite_user and satellite_password in plaintext Expected results: You shouldn't be able to get these values in any way through Satellite Additional info: It's expectable that the passwords are stored somewhere (e.g. database) and they can be accessed there
Created redmine issue https://projects.theforeman.org/issues/29465 from this bug
Upstream bug assigned to mhulan
Moving this bug to POST for triage into Satellite 6 since the upstream issue https://projects.theforeman.org/issues/29465 has been resolved.
Verified with Sat 6.7 snap 20. Passwords are now asterisked-out on the job invocation page. Note that any user with create_invocation permission can still see the entered password by clicking Rerun a looking into source code but that is by design (user with this permission can do potentially more dangerous things).
This was fixed in 6.7.