Re: ConnectionPoolMBean should not expose plain-text DB password

2012-10-08 Thread Mark H. Wood
On Fri, Oct 05, 2012 at 05:11:57PM -0400, Christopher Schultz wrote: > On 10/5/12 1:51 PM, Te Li wrote: > > I am not familiar with JIoEndpoint discussed in > > https://issues.apache.org/bugzilla/show_bug.cgi?id=53139. > > > > The issue I'm facing is something different. Apparently, some > > effor

Re: ConnectionPoolMBean should not expose plain-text DB password

2012-10-05 Thread Christopher Schultz
-BEGIN PGP SIGNED MESSAGE- Hash: SHA1 Te, On 10/5/12 1:51 PM, Te Li wrote: > I am not familiar with JIoEndpoint discussed in > https://issues.apache.org/bugzilla/show_bug.cgi?id=53139. > > The issue I'm facing is something different. Apparently, some > effort was made to hide the DB pas

Re: ConnectionPoolMBean should not expose plain-text DB password

2012-10-05 Thread Shanti Suresh
Hi Te, Yes, it would be very nice if the DB passwords don't get exposed via JMX. If we could have an additional role to get and set some of the sensitive MBeans, that would be really nice. More simply, if getDbProperties() can also simply return some dummy warning information, that will work. Th

Re: ConnectionPoolMBean should not expose plain-text DB password

2012-10-05 Thread Te Li
I am not familiar with JIoEndpoint discussed in https://issues.apache.org/bugzilla/show_bug.cgi?id=53139. The issue I'm facing is something different. Apparently, some effort was made to hide the DB password, but the DB password is still exposed via another getter (getDbProperties()). This seems t

Re: ConnectionPoolMBean should not expose plain-text DB password

2012-10-05 Thread Shanti Suresh
Hi Te, Will it be an option for you to create a JSP as was recently discussed in this list, to expose just the particular MBeans that you need? Thanks. -Shanti On Thu, Oct 4, 2012 at 3:06 PM, Christopher Schultz < ch...@christopherschultz.net> wrote: > -BEGIN PGP SIGNED ME

Re: ConnectionPoolMBean should not expose plain-text DB password

2012-10-04 Thread Christopher Schultz
-BEGIN PGP SIGNED MESSAGE- Hash: SHA1 Te, On 10/4/12 1:56 PM, Te Li wrote: > DB password is secret information and should not be exposed via > JMX. The tomcat ConnectionPool class implements > ConnectionPoolMBean interface. This interface exposes connection > pool configuration and statis

ConnectionPoolMBean should not expose plain-text DB password

2012-10-04 Thread Te Li
Hello, DB password is secret information and should not be exposed via JMX. The tomcat ConnectionPool class implements ConnectionPoolMBean interface. This interface exposes connection pool configuration and statistics. However, because this interface extends PoolConfiguration which has "getDbPr