Bug 715 - [AMP][WEBUI][API] Get list devices API exposes the device RESTAPI and CLI password in plaintext

Review Request #221 — Created April 15, 2024 and submitted

Information
pmurugaiyan
AMP
amp_3_6
715
Reviewers
apoorva.sn, prajesh, shuinvy 
Currenlt the REST APIs are exposing the console and RESTAPI passwords in plaintext as part the device details. To make our device data more secure made the passwords as None in the response. Now the current response strcuture is not modified, and also we are not exposing the sensitive data like the password. The user has to provide the password if they have to update the device configuration in future.
Changes are tested locally with lab AMP.

Description From Last Updated

console_paaaword is getting deleted from dictionary.. so why it is still shown in the API output?

 prajeshprajesh
prajesh
prajesh 
  1. 
  
    
 
    

 
    
  


    
 
    
 
      

  

 
    


    

 
    

    2. 

















  2. 
 
    
  
  
    
  
 

   
    
    
    



    
 
    
  
    
   
   
    
    
     
     
     
     
     
    
    Show all issues
   
  
    
 
    

    



    
    console_paaaword is getting deleted from dictionary.. so why it is still shown in the API output?
    
  
    
 
    

 
    
  


    
 
    
 
      

  


    1. 
 
 
      
 
      
  
 
      
 
      
  
      each['console_account'] = {'console_username':each['console_username'], 'console_password':each['console_password']}
      
del each['console_username']
      
del each['console_password']
      

      They are copying the values into "console_account", so they are removing the 'console_username', 'console_password' keys explicitly.
      
 
      

      2. 


 
    


    

 
    

    3. 




  3. 
 
    
  
    
   
    
  
    
 
    

 
    
  


    
 
    
 
      

  

 
    


    

 
    

    4. 




  

 
















 



 

  

   




pmurugaiyan




   

   

  

 



 















 





 

  

   




shuinvy




   

   







  

 



 

  


   

   

    
 
shuinvy


    
   


  

  

  



    




  1. 
 
    
  
    
   
    Ship It!
    
  
    
 
    

 
    
  


    
 
    
 
      

  

 
    


    

 
    

    2. 















  2. 
 
    
  
    
   
    
  
    
 
    

 
    
  


    
 
    
 
      

  

 
    


    

 
    

    3. 




  

 
















 





 

  

   




apoorva.sn




   

   







  

 



 

  


   

   

    
 
apoorva.sn


    
   


  

  

  



    




  1. 
 
    
  
    
   
    Ship It!
    
  
    
 
    

 
    
  


    
 
    
 
      

  

 
    


    

 
    

    2. 















  2. 
 
    
  
    
   
    
  
    
 
    

 
    
  


    
 
    
 
      

  

 
    


    

 
    

    3. 




  

 
















 



 

  

   




pmurugaiyan




   

   

  

 



 

  


   

   

    
 Review request changed

    
   


  

  

  






 

  Status:
  

  Closed (submitted)

  
 







 


 










  

 









     

    

   

  

  

   
   Loading...