Username and password being displayed in URL

Help
1

I just noticed this when we were linking some port error graphs to each other in my team.

Steps to reproduce:

  1. you must log out of librenms

  2. click a deep-link to a given port graph like:
    https://librenms.org/graphs/to=1527146700/id=4003/type=port_errors/from=1527060300/

  3. click login when presented with the librenms login screen.

  4. click the “year” graph

  5. username and password is now displayed in the URL in clear text.

screenshot: https://i.imgur.com/FVZpaVG.png

EDIT: my install has AD/LDAP integration. I’ve replicated this issue on other installs that also have AD integration.

2

Can’t replicate.

Are you saying you don’t need to login again at any stage?

3

allright, theres a step 2.5 “click login”

updating OP right now.

4

Can’t replicate on my server either.

5

the installs i’ve replicated it across all has AD/LDAP integration.

6

Can replicate it on all my LibreNMS instances.

1 Like
7

Issue seems to only exists when Apache is involved and there is a fix which mitigates this issue for now.
https://p.libren.ms/view/raw/0536472c

CLEAN UP YOUR ACCESS LOG IF YOU WERE AFFECTED

1 Like
8

Thanks @awlx. In my opinion they need to be unset earlier or prevented from being copied to $vars in the first place.

9

My proposed fix, can you guys test and verify?