Passwords in logs

[richa gautam]

When we use this plugin and enable detailed logging, the passwords are present in log files. Can we have that removed from log file? Also how is the password management done with this plugin? Where are the passwords stored? Aren't they encrypted?

[Alexander Renteln]

Hi @girlrichie,

yes, you are right. Although only with debugging enabled, passwords should never appear in the log. I will fix that. As to the passwords and where they are being stored, all data is stored in the hook-settings and the password cannot be "encrypted" as it has to be sent plain-text (base64 encoded) to the webserver with basic auth. But this key-value store can only be accessed by users having access to that hook-section.

Best, Alex

[richa gautam]

Thanks. Since its a critical scenario can we have this done on priority? Also can I know where can I find hook-settings? I have the admin rights on bitbucket but could not find anything regarding passwords. The settings->hook->gives a way to configure the hook (thats what I see). Please let me know how to I get to hook-settings? Thanks.

[richa gautam]

I just checked the Audit Log in Bitbucket and found that BitBucket also logs the hook settings so my password was there in plain text as well.

Is there any update son this issue ?

[Alexander Renteln]

remove pass from debug log (FIX: #28)

→ <<cset cd09971a13a9>>

[Alexander Renteln]

Hi Richa,

the password is now removed in from the logs. But there is no way to remove them from the audit logs. And as I have to store them somehow plain text on the server or at least encrypt them in a reversable fashion, they can never be safe against an attack from within - someone with admin privileges.

Best, Alex