[MNG-5265] enforce repository url verification for passing authz

• Type: Improvement
• Status: Closed
• Priority: Major
• Resolution: Auto Closed
• Affects Version/s: 2.0.10, 2.2.1, 3.0.2, 3.0.3, 3.0.4
• Component/s: Settings
• Assignee: Unassigned
• Reporter: Olivier Lamy
• Created: 20/Mar/12 18:47
• Updated: 16/Mar/18 22:37
• Resolved: 16/Mar/18 22:37

Description

Related discussion: http://markmail.org/message/7pswshucxc7qwtef

in your settings you have:

    <server>
      <username>olamy</username>
      <password>reallycomplicatedpassword</password>
      <id>foo.org</id>
    </server>

During dependencies resolution, you get a pom with a repository.

    <repository>
      <id>foo.org</id>
      <url>http://yourpasswordwillbehacked.org/</url>
    </repository>

Idea id in settings must contains the target hostname.