335668 2014-06-01 23:13:57 +0000 Dialog showing plaintext password while opening a remote (ftp) file in gnome application 2018-05-06 00:15:31 +0000 1 1 2 Applications krusader net-connection 2.4.0-beta3 "Single Step" Ubuntu Linux CONFIRMED HI critical --- 371796 1 simone.tedeschini krusader-bugs-null alex.bikadorov clearmartin jan_lepper krusader-bugs-null walch.martin 0 oldest_to_newest 1452555 0 simone.tedeschini 2014-06-01 23:13:57 +0000 Trying to open a remote file from a ftp server in gnome applications (e.g. pdfs in evince, txts in gedit, etc.), krusader launches the application through this command (seen in ps output): >>> /usr/bin/gedit ftp://user:{{password}@172.17.2.1:21/folder/file.txt where {{password}} is actually the password I previously entered in krusader to open the connection Then the classical gnome password dialog appears saying: "Enter password for user:{{password}@172.17.2.1:21" displaying the password Reproducible: Always Steps to Reproduce: 1.Connect to a pasword-protected ftp server 2.Open a file using a gnome application 3. Actual Results: Gnome password dialog shown the password in plaintext Expected Results: Don't show the password (don't include it in the command given to open the application) System environment: Ubuntu 13.04 Gnome 3.10.4 1452651 1 simone.tedeschini 2014-06-02 09:45:54 +0000 EDIT: It's Ubuntu 14.04, sorry 1549560 2 jan_lepper 2015-10-10 13:07:44 +0000 Note to self and other developers: This is most likeley caused by not using KUrl::prettyUrl() / QUrl::toDisplayString() which remove the password from the url string. Needs separate fix in kde4 branch and master. Places to check for right usage of KUrl/QUrl: Panel/panelfunc.cpp UserAction/expander.cpp and probably others ! 1582243 3 clearmartin 2016-03-13 12:36:45 +0000 Hi! I cannot replicate this issue on krusader-git. @simone.ted can you confirm that it is fixed? 1635131 4 alex.bikadorov 2016-10-24 19:55:30 +0000 Still in master. Must be fixed! 1635357 5 alex.bikadorov 2016-10-25 15:56:52 +0000 The problem is actually everywhere. If the initial ftp connection is made by writing the password in plain text into the navigation bar ("ftp://user:password@server.com") the password is never removed. * VFS uses the URL with the password while navigating on the ftp server * all file URLs contain the password, it is not removed when opening files or copying them to clipboard * sometimes debug output with the URL and password is printed Dolphin has exactly the same problems. Removing the password from all URLs is not that simple cause the password is never saved and browsing wont work after the first directory listing without entering the password again. The best solution would be if the KIO listing job saves the password internally and it can be removed after the first connection. This is currently done anyway if no password is provided and the authentication dialog appears. 1636131 6 alex.bikadorov 2016-10-28 19:12:32 +0000 I don't think we can solve this on our own. * either we remove the password from the URL and the user has to enter it again * or we stay with the current situation leaving the password in plain text everywhere. The latter case is highly insecure and we should at least tell the user about it. Maybe some warning dialog appearing or something.