unencrypted passwords in _settings table

roberto

Hello everyone,

I was looking at the database to understand how the system works and I noticed that the passwords in the _settings table are not encrypted.
I have seen that passwords are usually encrypted while in TastyIgniter’s db they are inking, is it an oversight or is there a specific reason?
Thanks
Roberto

sampoyigi

roberto You’ll have to encrypt the password before storing into the database.

roberto

Hi,
Thanks for the reply.

in the ti_settings table there is a field where the password is not encrypted, it shows the administrator password and username even if I have not understood what function this field has in this table, because the same data are reported in the ti_users table where they are encrypted instead .
Maybe it’s a field that is generated at the first installation and that is part of an old version?

sampoyigi

roberto Can you provide a screenshot of your ti_settings table?

roberto

https://posl.didosystem.com/Schermata.png

sampoyigi

roberto Can’t find anywhere in the code that saves username and password to the database except for the users and customers table which are properly encrypted.

roberto

Hi,

sorry, my incorrect english doesn’t make it easy for you to understand me.
I just tried to do a new web installation using the setup.php file
I followed the wizard and installed a new copy.
At the end of the installation I went to the database and in the ti_settings table the administrator username and password are clear and unencrypted (records n ° 84 and 85)
https://posl.didosystem.com/photo/

sampoyigi

roberto Strange, I don’t have these records in my local database and the demo database. Anyway, since others have confirmed the issue, create a github issue and I’ll come back to it later or someone else can chip in.

wakey18

I can confirm what roberto is saying, the main admin password is clearly visible in the setting table of the database. setting_id is 86

scooby420

The smtp password is also shown!!!!