Re: [pear-webmaster] PEAR site email

Hello Matthew, > Over the last couple of months I've started receiving a weird email > that appears to be from the PEAR site. The subject of the message > "Password for PEAR bug report #4623" and it's sent from > bounce-no-user@php.net. The entire (redacted) body of the email is: > >> The password for PEAR bug report #4623 is [redacted]. > > Any thoughts on what's going on here? The pear bug database allows unregistered users to submit bugs and attach a password to the bug report, so that they can edit the bug later by supplying the password. Those user passwords were indeed stored in plaintext in the database. I've purged all the user bug passwords now, which means that no further bug-password-lost mails will be sent out. The mails stemmed from someone accessing bugs/bug-pwd-finder.php with all bug IDs I guess. -- Regards/Mit freundlichen Grüßen Christian Weiske -=≡ Geeking around in the name of science since 1982 ≡=-

Attachment: [application/pgp-signature] signature.asc