GameServerManagers / GameServerManagers/LinuxGSM
Clear-Text Password Revealed in Valheim PostDetails Command
- Dominant language
- Shell
- Stars
- 4.9k
- Forks
- 864
- PR merge metrics
- No merged PRs in 30d
Description
## User Story
When using the postdetails command on vhserver, it says it will remove passwords. And is does in the "Valheim Server Details" section where the Server Password is redacted. But in the "Command-line Parameters", the password is revealed since the password is part of the command line to launch Valheim.
## Basic info
* **Distro:** [Ubuntu 20.04.2 LTS]
* **Game:** [Valheim]
* **Command:** [postdetails]
* **LinuxGSM version:** [v21.1.3]
## Further Information
What the postdetails command is used, it submits it to termbin.com and returns an associated termbin url for your details. When this command is used, it is supposed to redact the password. But as described above, it does not. Because the password it also in the "Command-line Parameters" section of Details. My off the cuff idea to fix this would be to create a function that will take the server password during setup and securely store it in a config file (preferably not in clear-text) and then be able call that password into the launch command via a variable. That way the command-line only shows the variable and not clear-text password. Then when postdetails is used, it can use the current function to redact it and not have to work about it being reveled elsewhere. And if you also want to have it revealed on the terminal through the Details command, you can still do that by calling it from said function to reveal it. And if a user needs to change the password, you would also just need to leverage the original setup function to collect the password from the user and update it in the secured (non-cleartext) location.
## To Reproduce
Steps to reproduce the behaviour:
1. Install Valheim with LinuxGSM
2. Configure the server with a password in the common.cfg file
3. Run ./vhserver postdetails from the default vhserver directory, which will output your unique termbin url
4. Copy/Paste that url to a browser or run it through curl
5. Scroll to the "Command-line Parameters" section of the Details to see the clear-text password in the command-line string
## Expected behaviour
For the clear-text password not to be publicly revealed anywhere unintentionally.
Contributor guide
Assessment
This issue has not been assessed yet.