monotone / indefero: information disclosure

Hi all!

Indefero's monotone plugin might disclose private key information when
Indefero's debug output is switched on.

Since monotone's frontend needs its own private key to authenticate
against a running server, this key is created on-the-fly when a new
project is created, added to the monotone instance and saved in the
project configuration for later usage.

Now when _any_ kind of exception triggers Pluf's error handler, the
current IDF_Project instance is dumped together with the said private
key data that are read from IDF's database.

Therefor please consider to disable Pluf's debug output when you run an
IDF instance with monotone support in production until I found a better
way to handle the frontend authentication issue. You can do this by setting

   $cfg['debug'] = false;

in your src/IDF/conf/idf.php.

Many thanks go to Frère Sébastien Marie <[email protected]> who
pointed me at this issue.

Thomas.

-- 
GPG-Key 0x160D1092 | [email protected] | http://thomaskeller.biz
Please note that according to the EU law on data retention, information
on every electronic information exchange might be retained for a period
of six months or longer: http://www.vorratsdatenspeicherung.de/?lang=en

_______________________________________________
Monotone-devel mailing list
[email protected]
https://lists.nongnu.org/mailman/listinfo/monotone-devel

-----BEGIN PGP SIGNATURE-----
Version: GnuPG v2.0.15 (GNU/Linux)
Comment: Using GnuPG with Mozilla - http://enigmail.mozdev.org/

iEYEARECAAYFAk22vE8ACgkQaf7NlBYNEJJCtgCeIVJWXpJTkAGo6l6afpDPJT6v
cH4AoPnfzD5tuthV47e73Uviy/EqOEVI
=ZQDd
-----END PGP SIGNATURE-----