[GitHub] [incubator-devlake] mindlesscloud opened a new issue, #2529: [Bug][Jira] The migration script did not encrypt password

[GitBox <gi...@apache.org>]

mindlesscloud opened a new issue, #2529:
URL: https://github.com/apache/incubator-devlake/issues/2529

   ### Search before asking
   
   - [X] I had searched in the [issues](https://github.com/apache/incubator-devlake/issues?q=is%3Aissue) and found no similar issues.
   
   
   ### What happened
   
   The migration script `InitSchemas` did not encrypt the password on saving.
   
   ### What you expected to happen
   
   All user passwords should be encrypted.
   
   ### How to reproduce
   
   By reading the code, we could find out that`conn.Password` was assigned with a plaintext password.
   ```go
   encKey := c.GetString("ENCODE_KEY")
   auth, err := core.Decrypt(encKey, v.BasicAuthEncoded)
   if err != nil {
   	return err
   }
   pk, err := base64.StdEncoding.DecodeString(auth)
   if err != nil {
   	return err
   }
   originInfo := strings.Split(string(pk), ":")
   if len(originInfo) == 2 {
   	conn.Username = originInfo[0]
   	conn.Password = originInfo[1]
   	// create
   	db.Create(&conn)
   }
   ```
   
   ### Anything else
   
   _No response_
   
   ### Version
   
   main
   
   ### Are you willing to submit PR?
   
   - [ ] Yes I am willing to submit a PR!
   
   ### Code of Conduct
   
   - [X] I agree to follow this project's [Code of Conduct](https://www.apache.org/foundation/policies/conduct)
   


-- 
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.

To unsubscribe, e-mail: commits-unsubscribe@devlake.apache.org.apache.org

For queries about this service, please contact Infrastructure at:
users@infra.apache.org

[GitHub] [incubator-devlake] warren830 closed issue #2529: [Bug][Jira] The migration script did not encrypt password

[GitBox <gi...@apache.org>]

warren830 closed issue #2529: [Bug][Jira] The migration script did not encrypt password 
URL: https://github.com/apache/incubator-devlake/issues/2529


-- 
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.

To unsubscribe, e-mail: commits-unsubscribe@devlake.apache.org

For queries about this service, please contact Infrastructure at:
users@infra.apache.org