[QA] oc_appconfig stores passwords unencrypted
Open
Nobody has claimed this yet.
QA:team
- Dominant language
- PHP
- Stars
- 8.8k
- Forks
- 2.1k
- Avg merge
- 20h 7m
- Merged PRs (30d)
- 41
Description
Seen in oc 10.8.0-beta2
#38728 encrypts mount passwords stored in the database. But there are more locations where passwords are stored unencrypted:
MariaDB [owncloud]> select * from oc_appconfig where configkey like '%pass%';
+-----------+------------------------+--------------+
| appid | configkey | configvalue |
+-----------+------------------------+--------------+
| user_ldap | s01ldap_agent_password | b3duY2xvdWQ= |
| user_ldap | s02ldap_agent_password | UEBzc3cwcmQ= |
+-----------+------------------------+--------------+
2 rows in set (0.005 sec)
These two are base64 encoded, and can be trivially converted back to their plain text representation (owncloud and P@ssw0rd)
Contributor guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
Start by tracing how the user_ldap s01ldap_agent_password and s02ldap_agent_password values are stored in oc_appconfig, using the behavior from #38728 as a reference. Done means these passwords are encrypted at rest rather than merely base64 encoded; verify the resulting database values and the LDAP configuration behavior.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- mariadb, php
- Domain
- database, security
- Issue type
- Bug
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 35/100