Project

General

Profile

Actions
Copy link

Bug #11769

closed
VG VG

Sanitize Captive Portal RADIUS MAC secret in status output

Bug #11769: Sanitize Captive Portal RADIUS MAC secret in status output

Added by Viktor Gurov over 5 years ago. Updated about 5 years ago.

Status:
Resolved
Priority:
Normal
Assignee:
Viktor Gurov
Category:
Diagnostics
Target version:
2.5.2
Start date:
04/01/2021
Due date:
% Done:

0%

Estimated time:
Plus Target Version:
21.05
Release Notes:
Default
Affected Version:
2.5.0
Affected Architecture:

Description

RADIUS MAC Secret (`<radmac_secret>`) is not sanitized:

...
 <captiveportal>
        <cpzone1>
            <zone>CPZONE1</zone>
            <descr></descr>
            <localauth_priv></localauth_priv>
            <zoneid>2</zoneid>
            <interface>lan</interface>
            <maxproc></maxproc>
            <timeout></timeout>
            <idletimeout></idletimeout>
            <trafficquota></trafficquota>
            <freelogins_count></freelogins_count>
            <freelogins_resettimeout></freelogins_resettimeout>
            <enable></enable>
            <auth_method>radmac</auth_method>
            <auth_server>radius - LocalRADIUS</auth_server>
            <auth_server2></auth_server2>
            <radacct_server>LocalRADIUS</radacct_server>
            <radacct_enable></radacct_enable>
            <reauthenticate></reauthenticate>
            <radmac_secret>password123</radmac_secret>
            <reauthenticateacct>stopstartfreeradius</reauthenticateacct>
            <httpsname></httpsname>
            <preauthurl></preauthurl>
            <blockedmacsurl></blockedmacsurl>

JP Updated by Jim Pingle over 5 years ago Actions
Copy link
 #2

  • Status changed from New to Pull Request Review
  • Target version set to CE-Next

JP Updated by Jim Pingle over 5 years ago Actions
Copy link
 #3

  • Status changed from Pull Request Review to Feedback
  • Target version changed from CE-Next to 2.6.0

PR was merged yesterday.

JP Updated by Jim Pingle over 5 years ago Actions
Copy link
 #4

  • Plus Target Version set to 21.05

JP Updated by Jim Pingle over 5 years ago Actions
Copy link
 #5

Already in 21.05 branch.

JP Updated by Jim Pingle over 5 years ago Actions
Copy link
 #6

  • Subject changed from Captive Portal RADIUS MAC Secret is not sanitized to Sanitize Captive Portal RADIUS MAC secret in status output

Updating subject for release notes.

ML Updated by Max Leighton over 5 years ago Actions
Copy link
 #7

  • Status changed from Feedback to Resolved

Tested in

2.6.0-DEVELOPMENT (amd64)
built on Sat May 22 01:04:36 EDT 2021
FreeBSD 12.2-STABLE

radmac_secret is now sanitized in the status_output. Marking the ticket resolved.

JP Updated by Jim Pingle over 5 years ago Actions
Copy link
 #8

  • Target version changed from 2.6.0 to 2.5.2

RB Updated by Renato Botelho about 5 years ago Actions
Copy link
 #9

  • Assignee set to Viktor Gurov
Actions
Copy link

Also available in: Atom