pgadmin-org / pgadmin-org/pgadmin4
Foreign Server User Mapping password visible
Nobody has claimed this yet.
- Dominant language
- Python
- Stars
- 3.8k
- Forks
- 891
- Avg merge
- 4d 7h
- Merged PRs (30d)
- 8
Description
Please note that security bugs or issues should be reported to security@pgadmin.org.
Describe the bug
When you have a "Foreign Data Wrappers" listed in pgAdmin and edit the User Mappings for a user, the password is listed in clear text.
In my opinion this is a bug since passwords are hidden in other places.
To Reproduce
Steps to reproduce the behavior:
- Go to a database with "Foreign Data Wrappers" that have User Mappings (like a postgres_fdw)
- Navigate all the way down to the User Mappings and select a user
- Now in Properties click Edit and go to Options page, there you see user & password listed in clear text.
Expected behavior
I expected the password to be listed as ******** or something else, that hides the password from prying colleague eyes.
Maybe show an option to display the password in plain text?
I do agree that it shouldn't be hidden like a Login/Group Roles password as you want the indication that it actually exists.
Error message
None
Screenshots
(See above)
Desktop (please complete the following information):
- OS: macOS Ventura 13.4.x
- Version: 7.4
- Mode: Desktop
- Package type: download from website
Additional context
Feel free to solve this in any other way than I suggest above.
Contributor guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
Start by reproducing the issue in pgAdmin's Foreign Data Wrappers > User Mappings > Properties > Options flow described in the report, then trace the relevant UI and password handling. Done means the password is not shown in clear text while the interface still indicates that a password exists; the issue names no files or tests.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- postgresql, python
- Domain
- database, security
- Issue type
- Bug
- Difficulty
- 3/5
- Estimated time
- 1-2 days
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 38/100