pgadmin-org / pgadmin-org/pgadmin4

Foreign Server User Mapping password visible

Open
#6,591 3 comments 0 reactions 0 assignees View on GitHub

Nobody has claimed this yet.

Bug
Dominant language
Python
Stars
3.8k
Forks
891
Avg merge
4d 7h
Merged PRs (30d)
8

Description

Please note that security bugs or issues should be reported to security@pgadmin.org.

Describe the bug

When you have a "Foreign Data Wrappers" listed in pgAdmin and edit the User Mappings for a user, the password is listed in clear text.
In my opinion this is a bug since passwords are hidden in other places.

To Reproduce

Steps to reproduce the behavior:

  1. Go to a database with "Foreign Data Wrappers" that have User Mappings (like a postgres_fdw)
  2. Navigate all the way down to the User Mappings and select a user
  3. Now in Properties click Edit and go to Options page, there you see user & password listed in clear text.

image

Expected behavior

I expected the password to be listed as ******** or something else, that hides the password from prying colleague eyes.
Maybe show an option to display the password in plain text?
I do agree that it shouldn't be hidden like a Login/Group Roles password as you want the indication that it actually exists.

Error message

None

Screenshots

(See above)

Desktop (please complete the following information):

  • OS: macOS Ventura 13.4.x
  • Version: 7.4
  • Mode: Desktop
  • Package type: download from website
    image

Additional context

Feel free to solve this in any other way than I suggest above.

Contributor guide

Open the contributing guide

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

Research direction

Start by reproducing the issue in pgAdmin's Foreign Data Wrappers > User Mappings > Properties > Options flow described in the report, then trace the relevant UI and password handling. Done means the password is not shown in clear text while the interface still indicates that a password exists; the issue names no files or tests.

Written by the indexing model from the issue text.

Assessment

Tech stack
postgresql, python
Domain
database, security
Issue type
Bug
Difficulty
3/5
Estimated time
1-2 days
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
38/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.