[DIRSTUDIO-971] connections.xml should not be globally-readable

• Type: Bug
• Status: Open
• Priority: Major
• Resolution: Unresolved
• Affects Version/s: 2.0.0-M8 (2.0.0.v20130628)
• Component/s: studio-connection
• Environment: Linux
• Assignee: Unassigned
• Reporter: Andrew Findlay
• Created: 21/Jan/14 18:02
• Updated: 22/Jan/14 17:04

Description

Connection parameters are stored in the file connections.xml
This can include bind DNs and passwords, which are stored in clear text.
The file is globally-readable, exposing these passwords to great risk.
Another bug notes that encrypted storage would be better, but please at least set the file mode so that it can only be read by its owner.
The file is re-created every time a connection is edited, so changing the file mode by hand does not solve the problem. A possible workaround for Linux is:
chmod 700 ~/.ApacheDirectoryStudio