apache / apache/couchdb

CouchDB only writes to the final file in the config chain

Open
#777 7 comments 0 reactions 0 assignees View on GitHub
enhancement
Dominant language
Erlang
Stars
7k
Forks
1.1k
Avg merge
1d 16h
Merged PRs (30d)
9

Description

## Expected Behavior
If you add a new admin using the `[admins]` section of the `locals.ini` file, the password should get salted and encrypted (using pkbdf2) after restarting CouchDB.

## Current Behavior
The password remains in plaintext while a copy is created in the 10-admins.ini file in the local.d directory where the encrypted password is stored.

Files after restarting CouchDB:
locals.ini
```ini
[admins]
;admin = mysecretpassword
testadmin = testpass
```

locals.d/10-admins.ini
```ini
[admins]
testadmin = -pbkdf2-1c9e78dae1afdf034b5777a62a8a7e8a0c8e93fd,56a7565edee375ebb7cb872185ea364c,10
```

## Possible Solution
Edit `local.ini` with encrypted password as well after parsing it on start-up.

## Your Environment

* Version used: CouchDB 2.1.0
* Operating System and version (desktop or mobile): Ubuntu 16.04

Contributor guide

Open the contributing guide

Research direction

Inspect the config chain involving locals.ini, local.ini, and local.d/10-admins.ini, then trace how startup parsing handles the [admins] section. Reproduce the restart behavior with the shown files and verify that the source configuration no longer retains the plaintext password while the encrypted value remains usable.

Written by the indexing model from the issue text.

Assessment

Tech stack
erlang
Domain
databases
Issue type
Bug
Difficulty
3/5
Estimated time
1-2 days
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
35/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.