RE: Wappush Contains Username/Password

Here's the xml file I used for pap:

<?xml version="1.0"?>
<!DOCTYPE pap PUBLIC "-//WAPFORUM//DTD PAP//EN"
          "http://www.wapforum.org/DTD/pap_1.0.dtd">
<pap>
  <push-message push-id="[email protected]"
  deliver-before-timestamp="2008-10-31T06:45:00Z"
  deliver-after-timestamp="2006-02-28T06:45:00Z"
  progress-notes-requested="false">
    <address address-value="WAPPUSH=+56978555555/[email protected]">
    </address>
  </push-message>
</pap>

And the si:

<?xml version="1.0"?>
    <!DOCTYPE si PUBLIC "-//WAPFORUM//DTD SI 1.0//EN" "http://www.wapforum.org/DTD/si.dtd">
<si>
        <indication href="http://random.url/" si-id="" action="signal-medium">
        Test message
        </indication>
</si>

The username/password are passed in the header of the request to kannel something like.
Authorization: Basic MD5HASHEDUserPass

Let me know if you need anything else :)
-------
Mathieu Bruneau


-----Original Message-----
From: Stipe Tolj [mailto:[email protected]] 
Sent: Thursday, November 29, 2007 10:56 AM
To: Mathieu Bruneau
Cc: [email protected]
Subject: Re: Wappush Contains Username/Password

Mathieu Bruneau schrieb:
> Yes, that's exactly want I wanted, remove the credentials since this is related to kannel functioning only. Not to wappush/sms in any way.
> 
> Here's an example line from our bearerbox_access log:
> 2007-11-27 19:17:48 Sent SMS [SMSC:smc1] [SVC:ppg] [ACT:] [BINF:] [from:1234] [to:+56978555555] [flags:-1:1:-1:-1:0] [msg:73:cc061fae871880757365726e616d6550407373773072642621008db1c39302056a0045c60c0372616e646f6d2e75726c0085030011030007010354657374206d657373616765000101] [udh:7:0605040B8423F0]
> 
> NB: I altered this to remove "sensible" information. I hope the format is still correct
> 
> If we decode it contains:
> username and P@assword which correspond to the ppg-username and ppg-password used. Since this is completely independent from the operator side I think this shouldn't be transmitted.

can you show us the PAP and content blocks itself too? So I can review at which 
point the credentials ARE necessary and where they are "bogus" to be send?

Thanks,
Stipe

-------------------------------------------------------------------
Kölner Landstrasse 419
40589 Düsseldorf, NRW, Germany

tolj.org system architecture      Kannel Software Foundation (KSF)
http://www.tolj.org/              http://www.kannel.org/

mailto:st_{at}_tolj.org           mailto:stolj_{at}_kannel.org
-------------------------------------------------------------------

-- 
This message has been scanned for viruses and
dangerous content by MailScanner, and is
believed to be clean.


No virus found in this outgoing message.
Checked by AVG Free Edition. 
Version: 7.5.503 / Virus Database: 269.16.10/1159 - Release Date: 2007-11-29 11:10