Db.addUser() appears in shell history, with cleartext passwords - MongoDB

Posted by tbassetto on Friday February 24, 2012 @06:26AM
from the jira.mongodb.org dept.

( 5 comments | 26 points | on HN )

Re:Db.addUser() appears in shell history, with cleartext pas... by mrspeaker on Friday February 24, 2012 @08:18AM (#3629054)

This was reported on Sep 06 2011... a suggested fix in the ticket was "should strip from history like .auth()".

Has it been fixed? What is the implications of having it in the console history?

[ Parent | on HN ]

Re:Db.addUser() appears in shell history, with cleartext pas... by hjalle on Friday February 24, 2012 @08:59AM (#3629175)

I tested some stuff with MongoDB about a month ago and I did notice the shell-history-thing with addUser at that time.

Edit: It is not fixed in 2.0.2 at least. (Tested now)

[ Parent | on HN ]

Re:Db.addUser() appears in shell history, with cleartext pas... by jye on Friday February 24, 2012 @09:35AM (#3629274)

Edit: Looks like it's available only in the local user history of the machine you perform the addUser.

So I guess the risk is low.

[ Parent | on HN ]

Re:Db.addUser() appears in shell history, with cleartext pas... by thspimpolds on Friday February 24, 2012 @10:27AM (#3629438)

MySQL has had this same problem forever. This isn't something "new". Its stored in the local users .mysql_history

[ Parent | on HN ]

Re:Db.addUser() appears in shell history, with cleartext pas... by mathias_10gen on Friday February 24, 2012 @07:25PM (#3631705)

Thanks for bringing this to our attention. It has just been fixed in master.

[ Parent | on HN ]