Password appears in log as plain text

[Fressikus]

Your complete account credentials and ZM URL are displayed in plain text in the logfile, including your password. Apparently, this is also true for the stored user profile DB on the phone.

[Simpler1]

Thanks for looking into this serious issue so quickly. I noticed that the password was removed from most locations in the log file, but following section has it removed once and displayed once:

DEBUG user profile retrieved:

[pliablepixels]

@Simpler1 right ,but does it show the password?

[pliablepixels]

As discussed with @Fressikus over email - as of today while the password is stored as plain text in the log file, it is removed when you export it or email it.

The new version does the following:
a) The password is removed inside the log file before its stored as well
b) For double protection, the user profile is also encrypted. Note that this is only simple encryption to disallow a scenario where someone gets access to your phone/device and extracts the profile from within the DB (for phones). When I say "simple" protection, I am using crypto-js and AES encryption, but the encryption key is static. Since my code is open, its possible to retrieve the key, get access to your phone, retrieve the profile from the DB and decrypt it. The only solution to this is a client-server key mechanism but as you know ZoneMinder itself doesn't support such mechanisms (it requires login/password in clear text via its login console), so more security is currently not possible.

[pliablepixels]

@Simpler1 - you were correct. Fixed -please check

[Simpler1]

@pliablepixels - Thanks for the fix. The password no longer appears in the log.