4 ms·
Db.addUser() appears in shell history, with cleartext passwords - MongoDB
- mrspeaker 15y agoThis was reported on Sep 06 2011... a suggested fix in the ticket was "should strip from history like .auth()". Has it been fixed? What is the implications of having it in the console history?
- hjalle 15y agoI tested some stuff with MongoDB about a month ago and I did notice the shell-history-thing with addUser at that time. Edit: It is not fixed in 2.0.2 at least. (Tested now)
- jye 15y agoEdit: Looks like it's available only in the local user history of the machine you perform the addUser. So I guess the risk is low.
- thspimpolds 15y agoMySQL has had this same problem forever. This isn't something "new". Its stored in the local users .mysql_history
- deleted 15y ago[deleted]
- mathias_10gen 15y agoThanks for bringing this to our attention. It has just been fixed in master.