Re: Re: [BUGS] BUG #10250: pgAdmin III 1.16.1 stores unescaped plaintext password

From: Akshay Joshi <akshay(dot)joshi(at)enterprisedb(dot)com>
To: Dave Page <dpage(at)pgadmin(dot)org>
Cc: Stephen Frost <sfrost(at)snowman(dot)net>, Heikki Linnakangas <hlinnakangas(at)vmware(dot)com>, dlo(at)isam(dot)kiwi, Pg Bugs <pgsql-bugs(at)postgresql(dot)org>, pgadmin-hackers <pgadmin-hackers(at)postgresql(dot)org>
Subject: Re: Re: [BUGS] BUG #10250: pgAdmin III 1.16.1 stores unescaped plaintext password
Date: 2014-05-15 06:39:25
Message-ID: CANxoLDc_wU0eCNhnwYaHm33osV7Jj41nzwBqO8ZPkEEmBqqQHg@mail.gmail.com
Views: Raw Message | Whole Thread | Download mbox | Resend email
Thread:
Lists: pgadmin-hackers pgsql-bugs

Hi Dave

I have fixed the escaping issue and tested it. It works fine for me.
Attached is the patch file, can you please review it.
If code looks good to you, can you please commit the code.

On Thu, May 8, 2014 at 2:34 PM, Akshay Joshi
<akshay(dot)joshi(at)enterprisedb(dot)com>wrote:

> Sure.
>
>
> On Thu, May 8, 2014 at 1:37 PM, Dave Page <dpage(at)pgadmin(dot)org> wrote:
>
>> Akshay, can you look into the quoting problem please.
>>
>> On Thu, May 8, 2014 at 1:07 AM, Stephen Frost <sfrost(at)snowman(dot)net> wrote:
>> > * Heikki Linnakangas (hlinnakangas(at)vmware(dot)com) wrote:
>> >> (forwarding to pgadmin-hackers)
>> >
>> > Ah.
>> >
>> >> On 05/07/2014 06:44 PM, Stephen Frost wrote:
>> >> >* dlo(at)isam(dot)kiwi (dlo(at)isam(dot)kiwi) wrote:
>> >> >>but when the credential contains the delimiter (colon) it fails to be
>> >> >>read back out and app responds with "invalid credentials".
>> >> >>
>> >> >>x.x.x.x:5432:*:username:password:with:colons
>> >> >
>> >> >Per the fine documentation, you need to escape any such usage with a
>> >> >backslash. Please review:
>> >>
>> >> Stephen, you missed the context. pgadmin3 saves .pgpass, when you
>> >> check the "store password" checkbox in the connection dialog. And
>> >> apparantly pgadmin3 doesn't do that escaping properly.
>> >
>> > Wow, that's pretty rough. Hopefully they'll be able to fix it soon. :)
>> >
>> > Thanks,
>> >
>> > Stephen
>>
>>
>>
>> --
>> Dave Page
>> Blog: http://pgsnake.blogspot.com
>> Twitter: @pgsnake
>>
>> EnterpriseDB UK: http://www.enterprisedb.com
>> The Enterprise PostgreSQL Company
>>
>
>
>
> --
> *Akshay Joshi*
> *Principal Software Engineer *
>
>
>
> *Phone: +91 20-3058-9517 Mobile: +91 976-788-8246*
>

--
*Akshay Joshi*
*Principal Software Engineer *

*Phone: +91 20-3058-9517Mobile: +91 976-788-8246*

Attachment Content-Type Size
Fixed_unescaped_password.patch application/octet-stream 3.2 KB

In response to

Responses

Browse pgadmin-hackers by date

  From Date Subject
Next Message Dave Page 2014-05-16 08:23:19 Re: Re: [BUGS] BUG #10250: pgAdmin III 1.16.1 stores unescaped plaintext password
Previous Message Дмитрий Ольшевский 2014-05-11 08:12:16 Re[2]: [pgadmin-hackers] building pgadmin on win7

Browse pgsql-bugs by date

  From Date Subject
Next Message olivier.macchioni 2014-05-15 13:09:45 BUG #10329: Could not read block 0 in file "base/56100265/57047884": read only 0 of 8192 bytes
Previous Message sidharthdeshpande 2014-05-14 22:56:27 BUG #10322: yum update fails on postgresql