Opened 10 years ago

Closed 10 years ago

Last modified 10 years ago

#12300 closed Patch - Bug Fix (fixed)

Patch: Running mythfilldatabase can expose Schedules Direct userid

Reported by: Bill Meek <keemllib@…> Owned by: paulh
Priority: minor Milestone: 0.27.5
Component: MythTV - Mythfilldatabase Version: Master Head
Severity: medium Keywords:
Cc: Ticket locked: no

Description

In (at least) three places in libs/libmythtv/datadirect.cpp, the temporary file name used will be logged when running mythfilldatabase -v general --loglevel info. Most commonly at line 1044. The user's SD userid will be part of that file name: 

2014-10-10 20:10:17.183423 I [12014/12014] CoreContext datadirect.cpp:1063 (DDPost) - Writing to temporary file: [/tmp/mythtv_ddp_2SE2oM/mythtv_dd_cache_1_<yourSdUserIdHere>_UTC_20141009010942_to_20141026010942]

Suggest the attached patch, as the file name is already under a randomly selected directory in /tmp and also includes the start and end times for the current session.

Tested on: v0.28-pre-2303-g0629905. To test, the backend must have more than 1 source. Single source backends don't create the file name in the same format.

Attachments (1)

mfdb-remove-login.patch.v0​ (726 bytes) - added by Bill Meek <keemllib@…> 10 years ago.

Download all attachments as: .zip

Change History (7)

Changed 10 years ago by Bill Meek <keemllib@…>

Attachment: mfdb-remove-login.patch.v0​ added

comment:1 Changed 10 years ago by paulh

Owner: changed from stuartm to paulh
Status: new → accepted

comment:2 Changed 10 years ago by Bill Meek <keemllib@…>

Resolution: → fixed
Status: accepted → closed

In 6750b358ec33c09bd651507ed57eb993ae5e5a39/mythtv:

mythfilldatabase: remove Schedules Direct userid from temporary file names

This removes the userid from the file name so it wont be exposed in any logs.

Fixes #12300.

Signed-off-by: Paul Harrison <pharrison@…>

comment:3 Changed 10 years ago by Bill Meek <keemllib@…>

In ee025527aec0f1bed588664d3061c69fb97a642b/mythtv:

mythfilldatabase: remove Schedules Direct userid from temporary file names

This removes the userid from the file name so it wont be exposed in any logs.

Fixes #12300.

Signed-off-by: Paul Harrison <pharrison@…>
(cherry picked from commit 6750b358ec33c09bd651507ed57eb993ae5e5a39)

comment:4 Changed 10 years ago by paulh

Milestone: unknown → 0.27.5

comment:5 Changed 10 years ago by Paul Harrison <pharrison@…>

In 2f2261d6e3bb78f029dbb38e4746314d6ca0a2b6/mythtv:

mythfilldatabase: remove the redundant assign to userid

Refs #12300.

comment:6 Changed 10 years ago by Paul Harrison <pharrison@…>

In 4cea476f411f5a2f146398ca20bd0b1046cb1f72/mythtv:

mythfilldatabase: remove the redundant assign to userid

Refs #12300.

(cherry picked from commit 2f2261d6e3bb78f029dbb38e4746314d6ca0a2b6)

Note: See TracTickets for help on using tickets.