redmine auth provider leaks misstyped passwords in log files

Question

Originally reported on Google Code with ID 466

Gitblit 1.6.0 on Windows 2012.

What steps will reproduce the problem?
1. configure redmine auth provider
2. try to connect with a wrong password
3. look your gitblit log files

2014-07-17 14:38:47 [WARN ] Failed to authenticate via username/password against Redmine
2014-07-17 14:38:47 [ERROR] Failed to authenticate via apikey against Redmine
java.io.IOException: Server returned HTTP response code: 401 for URL: http://mydomain.org:8080/redmine/users/current.json?key=mypassword

Redmine provide other ways to authenticate with an api key which could avoid this behavior
:
* passed in as a username with a random password via HTTP Basic authentication
* passed in as a "X-Redmine-API-Key" HTTP header

Regards

Reported by mereth78 on 2014-07-17 12:59:54

该提问来源于开源项目：gitblit/gitblit

Answer 1

Yeah, this should be addressed.

As for alternative authentication, I'll be happy to accept PRs for that.  I don't run
Redmine.

Reported by James.Moger on 2014-08-12 19:15:37 - Status changed: Accepted - Labels added: Milestone-1.6.1