Wappush Contains Username/Password

Hi,

 We remark today that our wappush were containing the credentials of the ppg-username (at least transmitted through the connection). After looking through the source I found that headers were usually removed after consumption (X-Kannel-*) for example. However the Authorization header weren't "consume" after authentification and thus are sent.

 Did I miss something and they are supposed to be removed somewhere else or is there any reason for keeping them there ?

 Attached the patch I think could solve this (adding 1 line )

Regards,

 
-------
Mathieu Bruneau


No virus found in this outgoing message.
Checked by AVG Free Edition. 
Version: 7.5.503 / Virus Database: 269.16.8/1154 - Release Date: 2007-11-27 11:40

--- wap_push_ppg_pushuser.c     2007-11-27 22:27:26.901186976 +0000
+++ wap_push_ppg_pushuser2.c    2007-11-27 22:31:36.829791336 +0000
@@ -810,6 +810,7 @@
           " authorization header");
     gwlist_destroy(auth_list, octstr_destroy_item);
     octstr_destroy(header_value);
+    http_header_remove_all(push_headers, "Authorization");
     return HEADER_AUTHENTICATION;

 no_response1: