{"action":"created","issue":{"url":"https://api.github.com/repos/librenms/librenms/issues/4127","repository_url":"https://api.github.com/repos/librenms/librenms","labels_url":"https://api.github.com/repos/librenms/librenms/issues/4127/labels{/name}","comments_url":"https://api.github.com/repos/librenms/librenms/issues/4127/comments","events_url":"https://api.github.com/repos/librenms/librenms/issues/4127/events","html_url":"https://github.com/librenms/librenms/issues/4127","id":172179175,"number":4127,"title":"PHP session contains user login credentials","user":{"login":"ekoyle","id":1048398,"avatar_url":"https://avatars.githubusercontent.com/u/1048398?v=3","gravatar_id":"","url":"https://api.github.com/users/ekoyle","html_url":"https://github.com/ekoyle","followers_url":"https://api.github.com/users/ekoyle/followers","following_url":"https://api.github.com/users/ekoyle/following{/other_user}","gists_url":"https://api.github.com/users/ekoyle/gists{/gist_id}","starred_url":"https://api.github.com/users/ekoyle/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/ekoyle/subscriptions","organizations_url":"https://api.github.com/users/ekoyle/orgs","repos_url":"https://api.github.com/users/ekoyle/repos","events_url":"https://api.github.com/users/ekoyle/events{/privacy}","received_events_url":"https://api.github.com/users/ekoyle/received_events","type":"User","site_admin":false},"labels":[],"state":"open","locked":false,"assignee":null,"assignees":[],"milestone":null,"comments":1,"created_at":"2016-08-19T17:20:46Z","updated_at":"2016-08-19T17:24:54Z","closed_at":null,"body":"mneth in IRC reported that ibrenms is storing passwords in the PHP session file.  I think this is an unnecessary security risk.\r\n\r\nIt looks like every page request will call reauthenticate() with a chained call to authenticate() if there is no cookie.  It looks like this is the only place where the password is used.  Should this be using a local variable instead of $_SESSION? It appears to be set around [html/includes/authenticate.php line 39-47](https://github.com/librenms/librenms/blob/bf2c522c899a41c726830d5bc63f95dc8f6e7a72/html/includes/authenticate.inc.php#L39) and then only used on line 64.\r\n\r\n#### Please note\r\n\r\n> Please read this information carefully.\r\n\r\n- [x] Is your install up to date? [Updating your install](http://docs.librenms.org/General/Updating/)\r\n- [ ] Please include all of the information between the `====================================` section of `./validate.php`.\r\n- [ ] If you would like us to add a new device then please provide the information asked for [here](http://docs.librenms.org/Support/FAQ/#faq20)\r\n- [x] Please provide as much detail as possible.\r\n"},"comment":{"url":"https://api.github.com/repos/librenms/librenms/issues/comments/241080333","html_url":"https://github.com/librenms/librenms/issues/4127#issuecomment-241080333","issue_url":"https://api.github.com/repos/librenms/librenms/issues/4127","id":241080333,"user":{"login":"f0o","id":1656377,"avatar_url":"https://avatars.githubusercontent.com/u/1656377?v=3","gravatar_id":"","url":"https://api.github.com/users/f0o","html_url":"https://github.com/f0o","followers_url":"https://api.github.com/users/f0o/followers","following_url":"https://api.github.com/users/f0o/following{/other_user}","gists_url":"https://api.github.com/users/f0o/gists{/gist_id}","starred_url":"https://api.github.com/users/f0o/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/f0o/subscriptions","organizations_url":"https://api.github.com/users/f0o/orgs","repos_url":"https://api.github.com/users/f0o/repos","events_url":"https://api.github.com/users/f0o/events{/privacy}","received_events_url":"https://api.github.com/users/f0o/received_events","type":"User","site_admin":false},"created_at":"2016-08-19T17:24:54Z","updated_at":"2016-08-19T17:24:54Z","body":"Correct, one of the many relics we inherit.\n\nThis will not be present in v2 :)\n\nLuckily the attack vector for this implies a breach into the filesystem of the nms's server. At which point one could easily drain a database dump and break the terribly outdated pw-lib we use.\n\nI guess I'm the pessimist again.\n\nNot saying we shouldn't fix this! Likely just an 'if' and drop the pwd storage ;)\n\nOn 19 August 2016 19:20:47 CEST, Eldon Koyle <notifications@github.com> wrote:\n>mneth in IRC reported that ibrenms is storing passwords in the PHP\n>session file.  I think this is an unnecessary security risk.\n>\n>It looks like every page request will call reauthenticate() with a\n>chained call to authenticate() if there is no cookie.  It looks like\n>this is the only place where the password is used.  Should this be\n>using a local variable instead of $_SESSION? It appears to be set\n>around [html/includes/authenticate.php line\n>39-47](https://github.com/librenms/librenms/blob/bf2c522c899a41c726830d5bc63f95dc8f6e7a72/html/includes/authenticate.inc.php#L39)\n>and then only used on line 64.\n>\n>#### Please note\n>\n>> Please read this information carefully.\n>\n>- [x] Is your install up to date? [Updating your\n>install](http://docs.librenms.org/General/Updating/)\n>- [ ] Please include all of the information between the\n>`====================================` section of `./validate.php`.\n>- [ ] If you would like us to add a new device then please provide the\n>information asked for\n>[here](http://docs.librenms.org/Support/FAQ/#faq20)\n>- [x] Please provide as much detail as possible.\n>\n>\n>-- \n>You are receiving this because you are subscribed to this thread.\n>Reply to this email directly or view it on GitHub:\n>https://github.com/librenms/librenms/issues/4127\n\n-- \nSent from my Android device with K-9 Mail. Please excuse my brevity."}}
{"actor":{"display_login":"f0o"}}