From: Robin Rosenberg Date: Thu, 10 Jul 2008 18:56:43 GMT Subject: Re: [JGIT PATCH 2/5] Don't display passwords on the console in fetch/push output Message-ID: <200807102056.43912.robin.rosenberg@dewire.com> In-Reply-To: <1215670403-19191-3-git-send-email-spearce@spearce.org> torsdagen den 10 juli 2008 08.13.20 skrev Shawn O. Pearce: > When we show the URI we just fetched or pushed against there may > be a user password embedded in that URI, as saved in the user's > .git/config file. We shouldn't display that in public to prying > eyes so nulling it out will give us a copy of the URI without that > field in it. > > Signed-off-by: Shawn O. Pearce > --- > .../src/org/spearce/jgit/pgm/Fetch.java | 2 +- > .../src/org/spearce/jgit/pgm/Push.java | 2 +- > 2 files changed, 2 insertions(+), 2 deletions(-) > > diff --git a/org.spearce.jgit/src/org/spearce/jgit/pgm/Fetch.java b/org.spearce.jgit/src/org/spearce/jgit/pgm/Fetch.java > index c9c997e..36a0592 100644 > --- a/org.spearce.jgit/src/org/spearce/jgit/pgm/Fetch.java > +++ b/org.spearce.jgit/src/org/spearce/jgit/pgm/Fetch.java > @@ -71,7 +71,7 @@ class Fetch extends TextBuiltin { > return; > > out.print("From "); > - out.print(tn.getURI()); > + out.print(tn.getURI().setPass(null)); We did this a while ago. Sort of patching broken stuff instead of fixing what's broken, thus we should make URIIsh.toiString not display the password. -- robin