CouchDB only writes to the final file in the config chain
- Dominant language
- Erlang
- Stars
- 7k
- Forks
- 1.1k
- Avg merge
- 1d 16h
- Merged PRs (30d)
- 9
Description
## Expected Behavior
If you add a new admin using the `[admins]` section of the `locals.ini` file, the password should get salted and encrypted (using pkbdf2) after restarting CouchDB.
## Current Behavior
The password remains in plaintext while a copy is created in the 10-admins.ini file in the local.d directory where the encrypted password is stored.
Files after restarting CouchDB:
locals.ini
```ini
[admins]
;admin = mysecretpassword
testadmin = testpass
```
locals.d/10-admins.ini
```ini
[admins]
testadmin = -pbkdf2-1c9e78dae1afdf034b5777a62a8a7e8a0c8e93fd,56a7565edee375ebb7cb872185ea364c,10
```
## Possible Solution
Edit `local.ini` with encrypted password as well after parsing it on start-up.
## Your Environment
* Version used: CouchDB 2.1.0
* Operating System and version (desktop or mobile): Ubuntu 16.04
Contributor guide
Research direction
Inspect the config chain involving locals.ini, local.ini, and local.d/10-admins.ini, then trace how startup parsing handles the [admins] section. Reproduce the restart behavior with the shown files and verify that the source configuration no longer retains the plaintext password while the encrypted value remains usable.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- erlang
- Domain
- databases
- Issue type
- Bug
- Difficulty
- 3/5
- Estimated time
- 1-2 days
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 35/100