Clear text cred display in mirror settings

[handnot2]

• Gitea version (or commit ref): 1.0.1
• Git version:
• Operating system: Debian Jesse arm
• Database (use [x]):
  • PostgreSQL
  • MySQL
  • SQLite
• Can you reproduce the bug at https://try.gitea.io:
  • Yes (provide example URL)
  • No
  • Not relevant
• Log gist:

Description

Create a mirror of a private repo by providing the GIT URL and credentials at the top of the
Mirror Settings section. Once the mirror is created, the page
(Settings > Mirror Settings > Mirror Address) shows the credential in clear (https://user:passwd@host:port/repo..).

It is better to remove this mirror address display. If it is still needed, at the least mask the password.

[bkcsoft]

Just using net/url doing the following should suffice (Pseudo-code, variables might be off, here be dragons)

// scheme://[userinfo@]host/path[?query][#fragment]
url, err := url.Parse(repo.MirrorAddress)
// err-check
url.User = nil
ctx.Data["MirrorAddress"] = url.String()

Ref: https://golang.org/pkg/net/url/#URL.String

if u.User is nil, userinfo@ is omitted.

[bkcsoft]

You can also (if you want to see that auth is used) do the following to show https://******@example.com/foobar.git

if url.User {
  url.User = url.User(`********`)
}

Ref: https://golang.org/pkg/net/url/#User

[tboerger]

IMHO this is not a real security issue because it's anyway only visible to repo admins. Beside that just replacing or wiping credentials without any workaround makes it impossible to update the settings without retyping the credentials over and over again.

[bkcsoft]

@tboerger to me it feels like a "over-the-shoulder" security issue, which IMO should be fixed. Though showing and editing doesn't have to be the same "box"

[stale]

This issue has been automatically marked as stale because it has not had recent activity. It will be closed if no further activity occurs during the next 2 weeks. Thank you for your contributions.

[stale]

This issue has been automatically marked as stale because it has not had recent activity. It will be closed if no further activity occurs during the next 2 weeks. Thank you for your contributions.

[stale]

This issue has been automatically closed because of inactivity. You can re-open it if needed.