Project

General

Profile

Actions

Bug #34573

closed

Settings defined by DSL are not properly encrypted

Added by Ondřej Ezr about 2 years ago. Updated about 2 years ago.

Status:
Closed
Priority:
Normal
Assignee:
Category:
Security
Target version:
Difficulty:
Triaged:
No
Fixed in Releases:
Found in Releases:

Description

The values set for the DSL defined settings are not properly encrypted.
This is caused by the encrypted flag not being propagated for newly created settings and thus only new Foreman instances are affected.

How to reproduce:

1. Remove contents of settings table
2. Start foreman
3. Set a encrypted setting e.g. root_pass to any value
4. See the value in database for this setting. (possibly also from console by `Setting.find_by(name: 'root_pass').read_attribute(:value)`


Files

34573.patch 34573.patch 7.34 KB Proposed patch v1 Ondřej Ezr, 03/08/2022 01:03 PM

Related issues 1 (0 open1 closed)

Related to Foreman - Feature #30862: Introduce SettingRegistry as a setting inventoryClosedOndřej EzrActions
Actions

Also available in: Atom PDF