[Bug] Password get written into the logfiles (TvServer) (1 Viewer)

[FreakyJ]

MediaPortal Version: 1.2.0 Beta
MediaPortal Skin: Default Wide
Windows Version: Windows 7 x64
CPU Type: AMD Athlon x2 245 Processor, 2900MHZ
HDD: WDC 2TB
Memory: 2GB DDR3
Motherboard:
Video Card:
Video Card Driver:
Sound Card:
Sound Card AC3:
Sound Card Driver:
1. TV Card: Cinergy C HD + CI
1. TV Card Type: DVB-C
1. TV Card Driver:
2. TV Card:
2. TV Card Type:
2. TV Card Driver:
3. TV Card:
3. TV Card Type:
3. TV Card Driver:
4. TV Card:
4. TV Card Type:
4. TV Card Driver:
MPEG2 Video Codec:
MPEG2 Audio Codec:
h.264 Video Codec:
Satelite/CableTV Provider:
HTPC Case:
Cooling:
Power Supply:
Remote: IMon Pad
TV: Samsung
TV - HTPC Connection: HDMI

Hello everybody,

tourettes told me here:
https://forum.team-mediaportal.com/...eeze-15-30-helps-98842/index2.html#post774411

that it shouldn't ever happen that MP writes passwords into the logfiles.
I attached logs and censored my PW with "__PWD__"
the full set of logs you can get in the thread mentioned above.

greets FreakyJ

 

[tourettes]

Seems that it is error logging thai fails to remove the password from the log files.

 

[FreakyJ]

AW: Password get written into the logfiles (TvServer)

the whole error is strange to me, why is MP loosing its DB connection? In earlier times I hadn't such an error and the DB is on the same PC, but that is a different issue I have to double check first

Do you have a glue whats wrong that MP doesn't censor my PW? oO

 

[FreakyJ]

AW: Password get written into the logfiles (TvServer)

*bump*
any news on that?

Edit:
The issue is still in current SVN...

 

[miroslav22]

Yea needs fixing but it's too late for anything else in 1.2.0 now. Perhaps we should just mention it on the wiki/release notes as something to be aware of?

99% of users won't use mysql for anything other than their tv database so it's not a massive security problem.

 

[miroslav22]

0003684: An exception generated for a failing database connection writes out the user's password from the connection string to error.log - MediaPortal Bugtracker

 

[FreakyJ]

AW: Password get written into the logfiles (TvServer)

thanks for adding this to mantis =)

 

[mm1352000]

Hi everyone

Here is a patch for this one. My approach was to hide the password from the Gentle.NET side. That seems more sensible than scanning all log entries as we currently seem to be doing. I don't know if that is actually necessary and I would actually like to remove it if it is unnecessary overhead. TV Server password hiding implementations that I could find are in:

Log4netLogger.cs
Log.cs
FileLogger.cs
Util.cs
TVController.cs

Anyhow, patch for Gentle attached...

mm

[Edit: example exception looks like this...
[COLLAPSE]2011-08-17 03:20:51.247070 [scheduler thread(17)]: scheduler: SchedulerWorker inner exception Error: DatabaseUnavailableUnclassified
Gentle.Common.GentleException: The database backend (provider MySQL) could not be reached.
Check the connection string: Server=umedia;Database=MpTvDb;User ID=root;Password=MediaPortal;charset=utf8;Connection Timeout=300; ---> MySql.Data.MySqlClient.MySqlException: Unable to connect to any of the specified MySQL hosts. ---> System.Exception: Exception of type 'System.Exception' was thrown.
at MySql.Data.MySqlClient.NativeDriver.Open()
--- End of inner exception stack trace ---
at MySql.Data.MySqlClient.NativeDriver.Open()
at MySql.Data.MySqlClient.Driver.Create(MySqlConnectionStringBuilder settings)
at MySql.Data.MySqlClient.MySqlPool.CheckoutConnection()
at MySql.Data.MySqlClient.MySqlPool.GetPooledConnection()
at MySql.Data.MySqlClient.MySqlPool.GetConnection()
at MySql.Data.MySqlClient.MySqlConnection.Open()
at Gentle.Provider.MySQL.MySQLProvider.GetConnection()
--- End of inner exception stack trace ---
at Gentle.Common.Check.FailWith(Severity severity, Error error, Exception e, String msg)
at Gentle.Common.Check.Fail(Exception e, Error error, Object[] args)
at Gentle.Provider.MySQL.MySQLProvider.GetConnection()
at Gentle.Framework.PersistenceBroker.Execute(SqlStatement stmt, IDbConnection dbConnection, IDbTransaction dbTransaction)
at Gentle.Framework.SqlStatement.Execute()
at TvDatabase.Schedule.FindOrphanedOnceSchedules()
at TvService.Scheduler.CheckAndDeleteOrphanedOnceSchedules()
at TvService.Scheduler.DoScheduleWork()
at TvService.Scheduler.SchedulerWorker()MySql.Data.MySqlClient.MySqlException: Unable to connect to any of the specified MySQL hosts. ---> System.Exception: Exception of type 'System.Exception' was thrown.
at MySql.Data.MySqlClient.NativeDriver.Open()
--- End of inner exception stack trace ---
at MySql.Data.MySqlClient.NativeDriver.Open()
at MySql.Data.MySqlClient.Driver.Create(MySqlConnectionStringBuilder settings)
at MySql.Data.MySqlClient.MySqlPool.CheckoutConnection()
at MySql.Data.MySqlClient.MySqlPool.GetPooledConnection()
at MySql.Data.MySqlClient.MySqlPool.GetConnection()
at MySql.Data.MySqlClient.MySqlConnection.Open()
at Gentle.Provider.MySQL.MySQLProvider.GetConnection()System.Exception: Exception of type 'System.Exception' was thrown.
at MySql.Data.MySqlClient.NativeDriver.Open()[/COLLAPSE]
]