neolink
neolink copied to clipboard
QuantumEntangledAndy
Full Config with *unobscured* passwords is stored in MQTT broker
Describe the bug A full config is dropped in the MQTT broker under /neolink/config which shows unobscured passwords!
To Reproduce Steps to reproduce the behavior. Example:
- Create this configuration file: Any config with MQTT enabled
- Launch Neolink:
- Open a MQTT Explorer/Client and lookup /neolink/config
Expected behavior Not to find a config file in the MQTT broker, or at least with the passwords obscured.
Versions NVR software: N/A Neolink software: 0.6.3.rc.2 Reolink camera model and firmware: N/A
Yeah I know I keep meaning to fix this but other things keep comming up. You can make a PR if you have the time
Currently that config is watched so any changes in it are used to update the live camera. So you can add and remove cameras using it. It is run though the same de-serialization as the on disk config code and would need some sort of middle man to strip and add the passwords inbetween the deserialisation and serialisation
Wouldn't it not be simpler to just not send the config over MQTT?
We do send the config over mqtt. That is the issue since the config is sent unaltered including the passwords
Ah yes I see. That would limit what could be changed over mqtt. Currently you can use mqtt to change all camera options and settings by updating the config there. I supposed it could be made optional. I am a bit busy with work to do this change at the moment though.
Why would it limit what can be changed? It can still allow for changing everything, just don't send the config in the beginning.
The code is setup using a watch channel. Any change in config will be posted. So on first change of a setting (via another mqtt command) it will post the updated live config. It would have to be completely disable printing of config.
If you want the change I recommend you open a PR with the change.
Id still prefer a full change that replaces them with *** or something since it can be used to check configuration over mqtt and that requested mqtt command have taken effect. It also makes it possible to copy the current config make small changes then post the updates
P.s. I don't you mqtt much myself but when I do it's my own server hosted on my docker compose. Is it common to use an untrusted server?