{"thread":{"id":"30907","subject":"Fwd: [bug report, possibly] Multiple pushes with passwords in URL","startedAt":"2012-06-26T18:43:22Z","lastAt":"2012-07-02T09:09:14Z","messageCount":3,"participants":["Left Right","Kevin"],"isPatch":false,"patchVersion":null,"patchTotal":null},"messages":[{"id":"194298","messageId":"CAJQBtg=XN1Txsp8Q3C=GgxyZQvCK3vAJouJkXfZgwtG9hvuubw@mail.gmail.com","threadId":"30907","inReplyTo":"CAJQBtg=-drwKEU2iSDeUWZPbO+OENNL-rDMoy6XYPrnzFV1VyQ@mail.gmail.com","subject":"Fwd: [bug report, possibly] Multiple pushes with passwords in URL","fromName":"Left Right","fromEmail":"olegsivokon@gmail.com","sentAt":"2012-06-26T18:43:22Z","receivedAt":"2012-06-26T18:43:22Z","isPatch":false,"sender":{"key":"olegsivokon@gmail.com","avatar":null},"body":"Hello list,\nI didn't find a bug tracker and some comments on StackOverflow\nsuggested I should post to the mailing list... please excuse me if I\nfollowed the wrong info, it's not really easy to find your bug\ntracker, if there is one.\n\nI've came across this behavior trying to organize my repository to\npush updates to several remote repositories. Here's what I did:\n\nin .git/conf\n\n[core]\nrepositoryformatversion = 0\nfilemode = true\nbare = false\nlogallrefupdates = true\n\n[remote \"github\"]\n        fetch = +refs/heads/*:refs/remotes/origin/*\nurl = https://username1:password1@github.com/some.git\n\n[remote \"googlecode\"]\n        fetch = +refs/heads/*:refs/remotes/origin/*\n        url = https://username2:password2@code.google.com/p/some/\n\n[remote \"origin\"]\nurl = https://username1:password1@github.com/some.git\n#        url = https://username2:password2@code.google.com/p/some/\n\n[remote \"all\"]\nurl = https://username1:password1@github.com/some.git\n        url = https://username2:password2@code.google.com/p/some/\n[branch \"master\"]\nremote = origin\nmerge = refs/heads/master\n\nNow, what happens if I try to push origin master:\nthe commit is sent to the first origin with the credential specified\nin the first URL, but then the request to second URL is sent with the\ncredentials from the first URL. I tried switching them, and the result\nis the same. I tried separate push'es to both repositories and it\nworks fine. I thought there might be something particular about\n\"origin\" and tried moving the list of URLs to \"all\" - with the exact\nsame results.\n\nThis is kind of frustrating... but this is also a tiny security threat\nas you are basically sending the credentials of the users they used at\none site to another... w/o any notice or warning.\n\nThat aside, I would be very happy to find some way to save passwords\nin some... well... more secure format. Like on the keyring, for\nexample... .netrc is out of question though because of duplicating\nuser names :(\n\nBest.\n\nOleg\n"},{"id":"194461","messageId":"CAO54GHCS+KYeUYjK5oStJpi_Ztw5bXduCUqWecoi-QzDEFjG8g@mail.gmail.com","threadId":"30907","inReplyTo":"CAJQBtg=XN1Txsp8Q3C=GgxyZQvCK3vAJouJkXfZgwtG9hvuubw@mail.gmail.com","subject":"Re: [bug report, possibly] Multiple pushes with passwords in URL","fromName":"Kevin","fromEmail":"ikke@ikke.info","sentAt":"2012-07-02T07:17:32Z","receivedAt":"2012-07-02T07:17:32Z","isPatch":false,"sender":{"key":"ikke@ikke.info","avatar":"https://gravatar.com/avatar/60a0d08eeccb16914fdbfc7f3441548dc827dc436d5c6900ec6600e274e53c5b?d=mp&s=160"},"body":"Hi,\n\nFirst, this is the right place for reporting bugs.\n\nI don't know why it's using the credentials for the first remote. But I know\nthat recent versions of git ship a credentials[1] helper that can ask a wallet\nor keychain for credentials, so you don't have to store them in the git\nconfig.\n\nKevin\n\n\n[1]: http://git-scm.com/docs/gitcredentials\n\nOn Tue, Jun 26, 2012 at 8:43 PM, Left Right wrote:\n> Hello list,\n> I didn't find a bug tracker and some comments on StackOverflow\n> suggested I should post to the mailing list... please excuse me if I\n> followed the wrong info, it's not really easy to find your bug\n> tracker, if there is one.\n>\n> I've came across this behavior trying to organize my repository to\n> push updates to several remote repositories. Here's what I did:\n>\n> in .git/conf\n>\n> [core]\n> repositoryformatversion = 0\n> filemode = true\n> bare = false\n> logallrefupdates = true\n>\n> [remote \"github\"]\n> fetch = +refs/heads/*:refs/remotes/origin/*\n> url = https://username1:password1@github.com/some.git\n>\n> [remote \"googlecode\"]\n> fetch = +refs/heads/*:refs/remotes/origin/*\n> url = https://username2:password2@code.google.com/p/some/\n>\n> [remote \"origin\"]\n> url = https://username1:password1@github.com/some.git\n> # url = https://username2:password2@code.google.com/p/some/\n>\n> [remote \"all\"]\n> url = https://username1:password1@github.com/some.git\n> url = https://username2:password2@code.google.com/p/some/\n> [branch \"master\"]\n> remote = origin\n> merge = refs/heads/master\n>\n> Now, what happens if I try to push origin master:\n> the commit is sent to the first origin with the credential specified\n> in the first URL, but then the request to second URL is sent with the\n> credentials from the first URL. I tried switching them, and the result\n> is the same. I tried separate push'es to both repositories and it\n> works fine. I thought there might be something particular about\n> \"origin\" and tried moving the list of URLs to \"all\" - with the exact\n> same results.\n>\n> This is kind of frustrating... but this is also a tiny security threat\n> as you are basically sending the credentials of the users they used at\n> one site to another... w/o any notice or warning.\n>\n> That aside, I would be very happy to find some way to save passwords\n> in some... well... more secure format. Like on the keyring, for\n> example... .netrc is out of question though because of duplicating\n> user names :(\n>\n> Best.\n>\n> Oleg\n> --\n> To unsubscribe from this list: send the line \"unsubscribe git\" in\n> the body of a message to majordomo@vger.kernel.org\n> More majordomo info at http://vger.kernel.org/majordomo-info.html\n"},{"id":"194465","messageId":"CAJQBtgmg=-7TxKzEp7SH68UpMmGJha7kQ_MrhTVr+CPDp-WfHA@mail.gmail.com","threadId":"30907","inReplyTo":"CAO54GHCS+KYeUYjK5oStJpi_Ztw5bXduCUqWecoi-QzDEFjG8g@mail.gmail.com","subject":"Re: [bug report, possibly] Multiple pushes with passwords in URL","fromName":"Left Right","fromEmail":"olegsivokon@gmail.com","sentAt":"2012-07-02T09:09:14Z","receivedAt":"2012-07-02T09:09:14Z","isPatch":false,"sender":{"key":"olegsivokon@gmail.com","avatar":null},"body":"I have Git version 1.7.2.5 (this is what Debian repository provides), so\n\n$ git help -a | grep credential-\n\ndoesn't find anything. But thanks, I've put that page into favorites.\nOnce there will be a newer version, I'll try that.\n\nBest.\n\nOleg\n"}]}