Add a SECURE style flag for ThreadSafeMessageBox, which indicates that the message contains sensitive information #5095

pull maaku wants to merge 1 commits into bitcoin:master from maaku:rpcpassword-in-debug-log changing 4 files +12 −2

maaku commented at 11:23 PM on October 16, 2014: contributor

This keeps the message from being output to the debug log by bitcoind. Fixes a possible security risk when starting bitcoind in server mode without the 'rpcpassword' option configured, resulting in the "suggested" password being output to the debug log.

Fixes #5094.

in src/noui.cpp:None in ea48502838 outdated

  13 | @@ -14,6 +14,9 @@
  14 |  
  15 |  static bool noui_ThreadSafeMessageBox(const std::string& message, const std::string& caption, unsigned int style)
  16 |  {
  17 | +    bool fSecure = style & CClientUIInterface::SECURE;
  18 | +    style ^= CClientUIInterface::SECURE;

sipa commented at 11:44 PM on October 16, 2014:

Sure you don't mean:

style &= ~CClientUIInterface::SECURE

here?

maaku commented at 6:56 AM on October 17, 2014:

Whoops, yep. The first version had that line inside an if (fSecure) block. Fixing...

laanwj commented at 6:31 AM on October 17, 2014: member

Looks like an acceptable solution to me (apart from sipa's nit).
Add a SECURE style flag for ThreadSafeMessageBox, which indicates that the message contains sensitive information. This keeps the message from being output to the debug log by bitcoind. Fixes a possible security risk when starting bitcoind in server mode without the 'rpcpassword' option configured, resulting in the "suggested" password being output to the debug log. d4746d56c0
maaku force-pushed on Oct 17, 2014
maaku commented at 6:52 PM on October 17, 2014: contributor

Pushed an update last night fixing sipa's correct nit.

TheBlueMatt commented at 12:30 AM on October 18, 2014: member

laanwj merged this on Oct 20, 2014
laanwj closed this on Oct 20, 2014
laanwj referenced this in commit 64ffc995d6 on Oct 20, 2014
laanwj commented at 9:37 AM on October 20, 2014: member

Tested ACK
DrahtBot locked this on Sep 8, 2021

Contributors

Linked (view graph)