Project

General

Profile

Actions

Bug #41990

closed

Feature #47765: mgr/dashboard: security improvements

mgr/dashboard: hide Python tracebacks in response errors

Added by Ernesto Puerta over 4 years ago. Updated about 3 years ago.

Status:
Resolved
Priority:
Normal
Category:
General - Back-end
Target version:
-
% Done:

0%

Source:
Community (dev)
Tags:
security
Backport:
nautilus
Regression:
No
Severity:
2 - major
Reviewed:
Affected Versions:
ceph-qa-suite:
Pull request ID:
Crash signature (v1):
Crash signature (v2):

Description

Currently all errors handled by Cherrypy tools result in Python traceback including sensitive context information (Python version, file locations, packages, etc).

This does not only pose a security risk, but also pollutes logs with traceback lines, which makes it really hard to find where an unexpected traceback happened.

This could be easily fixed by setting Cherrypy environment to production


Related issues 2 (0 open2 closed)

Has duplicate Dashboard - Feature #38280: mgr/dashboard: add DEBUG modeDuplicate

Actions
Copied to Dashboard - Backport #42294: nautilus: mgr/dashboard: hide Python tracebacks in response errorsResolvedActions
Actions

Also available in: Atom PDF