2009/9/6 <[email protected]> > Package: analog > X-debbugs-cc: [email protected] > Severity: wishlist > Tags: security > > In analog 6.0 one sees > Listing referring URLs, sorted by the number of failed requests. > #reqs URL > ... > 1 http://user:[email protected]/stats/main.html > > I changed the details above, but I can't change them on the Dreamhost > stats pages, therefore I must close the stats area for sysops other than > me. > > Therefore analog should consider some masking when encountering > "://user:password@" strings in URLs. Mask not only the text, but the href= > too. > > (Yes, that failed link worked fine the next day.) > > > I am the upstream author. I tend to feel that the fault is in the browser for retaining sensitive information in the referrer. But in any case, you can use analog's REFALIAS command to modify the referrer and remove the information.
-- Stephen Turner
