RE: Wappush Contains Username/Password
"Mathieu Bruneau" <[email protected]>
| Newsgroups | gmane.comp.mobile.kannel.devel |
|---|---|
| Message-ID | <[email protected]> |
Yes, that's exactly want I wanted, remove the credentials since this is related to kannel functioning only. Not to wappush/sms in any way. Here's an example line from our bearerbox_access log: 2007-11-27 19:17:48 Sent SMS [SMSC:smc1] [SVC:ppg] [ACT:] [BINF:] [from:1234] [to:+56978555555] [flags:-1:1:-1:-1:0] [msg:73:cc061fae871880757365726e616d6550407373773072642621008db1c39302056a0045c60c0372616e646f6d2e75726c0085030011030007010354657374206d657373616765000101] [udh:7:0605040B8423F0] NB: I altered this to remove "sensible" information. I hope the format is still correct If we decode it contains: username and P@assword which correspond to the ppg-username and ppg-password used. Since this is completely independent from the operator side I think this shouldn't be transmitted. About the memory leak, I'm not sure if you're asking if there was a memory leak before. If that was the question... No memory-leak I could see :) If it's after my modification, I didn't use it on a server with enough messages to see (only manual test) and I don't know the internal enough sorry :) Regards, ------- Mathieu Bruneau -----Original Message----- From: Stipe Tolj [mailto:[email protected]] Sent: Wednesday, November 28, 2007 10:52 AM To: Mathieu Bruneau Cc: [email protected] Subject: Re: Wappush Contains Username/Password Mathieu Bruneau schrieb: > Hi, > > We remark today that our wappush were containing the credentials of the ppg-username (at least transmitted through the connection). After looking through the source I found that headers were usually removed after consumption (X-Kannel-*) for example. However the Authorization header weren't "consume" after authentification and thus are sent. > > Did I miss something and they are supposed to be removed somewhere else or is there any reason for keeping them there ? > > Attached the patch I think could solve this (adding 1 line ) Hi Mathieu, thanks a lot for your patch. I need some clearing here. There is no resulting mem-leaking here due the issue, right? Since we will gwlist_desttroy() the list in the upper calling layer. What you want is to "remove" the header in order not to pass credential informations further? Can you drop an example which reflects the situation, so I can see it in a glance without jumping into the deeps of PPG code again? ;) Stipe ------------------------------------------------------------------- Kölner Landstrasse 419 40589 Düsseldorf, NRW, Germany tolj.org system architecture Kannel Software Foundation (KSF) http://www.tolj.org/ http://www.kannel.org/ mailto:st_{at}_tolj.org mailto:stolj_{at}_kannel.org ------------------------------------------------------------------- -- This message has been scanned for viruses and dangerous content by MailScanner, and is believed to be clean. No virus found in this outgoing message. Checked by AVG Free Edition. Version: 7.5.503 / Virus Database: 269.16.9/1157 - Release Date: 2007-11-28 12:29