Bug#436681: backuppc: Web interface password publicly visible

2007-08-31 Thread Frans Pop
On Monday 27 August 2007, Ludovic Drolez wrote: > I've just added a new db_subst with an empty value in the postinst. It > should fix the problem. (db_subst "backuppc/configuration-note" "pass" > "") I've taken a look at the code and IMO you should also db_reset the variable immediately after the

Bug#436681: backuppc: Web interface password publicly visible

2007-08-27 Thread Ludovic Drolez
Le lundi 13 août 2007 15:39, Frans Pop a écrit : > Note that you will also have to clear values in the debconf database for > existing installs on upgrades from a broken version. I've just added a new db_subst with an empty value in the postinst. It should fix the problem. (db_subst "backuppc/con

Bug#436681: backuppc: Web interface password publicly visible

2007-08-13 Thread Frans Pop
On Monday 13 August 2007, you wrote: > Thanks for the report ! What's strange is that the password should be in > passwords.dat, not in config.dat... Anyway it should be cleared. I know debconf quite well because of my work on Debian Installer and that's only true if you ask a user to _input_ a p

Bug#436681: backuppc: Web interface password publicly visible

2007-08-13 Thread Ludovic Drolez
On Wed, Aug 08, 2007 at 03:58:39PM +0200, Frans Pop wrote: > Package: backuppc > Version: 2.1.2-6 > Severity: critical > Tags: security > > The default password generated at installation time is publically > visible to any user with local access to the system on which backuppc is > installed as it

Bug#436681: backuppc: Web interface password publicly visible

2007-08-08 Thread Frans Pop
Package: backuppc Version: 2.1.2-6 Severity: critical Tags: security The default password generated at installation time is publically visible to any user with local access to the system on which backuppc is installed as it is included in the debconf database [1] as a variable for the backuppc/con