Project

General

Profile

Actions
Copy link

Bug #10794

closed

HAProxy Stats page credentials are not redacted in status.php

Added by Steve Wheeler over 3 years ago. Updated over 3 years ago.

Status:
Resolved
Priority:
Normal
Assignee:
Renato Botelho
Category:
Diagnostics
Target version:
2.5.0
Start date:
07/28/2020
Due date:
% Done:

100%

Estimated time:
Plus Target Version:
Release Notes:
Affected Version:
All
Affected Architecture:
All

Description

The status_output file generated by status.php does not redact the HAProxy stats page login details:

                    <stats_enabled></stats_enabled>
                    <stats_username>admin</stats_username>
                    <stats_password>topsecret</stats_password>
                    <stats_uri></stats_uri>

They are also not shown by default which makes it hard to find them or spot of a browser has auto-filled it.

Actions
Copy link

Also available in: Atom PDF