Re: Wappush Contains Username/Password

Mathieu Bruneau schrieb:
> Hi,
> 
>  We remark today that our wappush were containing the credentials of the ppg-username (at least transmitted through the connection). After looking through the source I found that headers were usually removed after consumption (X-Kannel-*) for example. However the Authorization header weren't "consume" after authentification and thus are sent.
> 
>  Did I miss something and they are supposed to be removed somewhere else or is there any reason for keeping them there ?
> 
>  Attached the patch I think could solve this (adding 1 line )

Hi Mathieu,

thanks a lot for your patch.

I need some clearing here. There is no resulting mem-leaking here due the issue, 
right? Since we will gwlist_desttroy() the list in the upper calling layer.

What you want is to "remove" the header in order not to pass credential 
informations further?

Can you drop an example which reflects the situation, so I can see it in a 
glance without jumping into the deeps of PPG code again? ;)

Stipe

-------------------------------------------------------------------
Kölner Landstrasse 419
40589 Düsseldorf, NRW, Germany

tolj.org system architecture      Kannel Software Foundation (KSF)
http://www.tolj.org/              http://www.kannel.org/

mailto:st_{at}_tolj.org           mailto:stolj_{at}_kannel.org
-------------------------------------------------------------------