Don't send plaintext RSS password back to browser

This is similar to https://bugs.launchpad.net/mahara/+bug/611045 - if it's not stored in cleartext, the feed can't be updated later. I guess there could be an option to grab the feed once only on block configuration, then throw the password away, but I think the default should be to store and do updates.

The scope of this is a bit larger than the LDAP credentials, given the potential variety in accessible domains.

One could potentially use key-based encryption, storing the key in config.php, using mcrypt. It wouldn't be bulletproof, but it would prevent against SQL injection attacks or misplaced database dumps.

https://reviews.mahara.org/#/c/1440/

Do you have an RSS feed with credentials that can be used for testing, Son?

Hi Kristina;

I will create an authenticated RSS for you to test.

For testing:

URL: http://ptcjsc.com/wp/?feed=rss2
Username: tester
Password: qwe123

This one's got a fix that was verified and code-reviewed, but now the rebase causes conflicts. So, we should try to get it straightened out for inclusion in 1.8.0, and 1.7.1 (since leaving sensitive information unencrypted is a security problem).

Hm, there are actually two pieces to this bug, which can be implemented separately.

1. Encrypt the RSS feed passwords (and usernames? and maybe even URLs?) in the database, so that a SQL injection vuln that allows people to read the DB won't expose the passwords.

2. Don't send the plaintext passwords (and/or usernames and/or URLs) to the user's browser, so that people who gain access to their account won't be able to read them.

There was a bug in how Mahara handled it when you edited the username or password on an authenticated RSS feed. That was making it difficult to test this bug, so I've fixed it first: https://reviews.mahara.org/2095

And here's the fix to issue #2 mention in my previous comment, "Don't send the plaintext passwords (and/or usernames and/or URLs) to the user's browser:

https://reviews.mahara.org/2096

I think we should push this with the security release early this week, and we can work on encrypting them in the database for the next release.

Another minor bug fix under this same heading. Leap2A export format should not include plaintext RSS block password, or else that provides a handy way to bypass the password secrecy.

https://reviews.mahara.org/2098

Committed and backported to 1.5, 1.6, and 1.7:

Don't include RSS passwords in Leap2A:
• master: https://reviews.mahara.org/#/c/2098/
• 1.7: https://reviews.mahara.org/#/c/2106
• 1.6: https://reviews.mahara.org/#/c/2107
• 1.5: https://reviews.mahara.org/#/c/2108

terminal error with mistaken in auth RSS feed:
• master: https://reviews.mahara.org/#/c/2095/
• 1.7: https://reviews.mahara.org/2109
• 1.6: I accidentally just pushed it instead of submitting to gerrit
• 1.5: https://reviews.mahara.org/2110

don't send RSS password in plaintext:
• master: https://reviews.mahara.org/#/c/2096
• 1.7: https://reviews.mahara.org/#/c/2111
• 1.6: https://reviews.mahara.org/#/c/2112
• 1.5: https://reviews.mahara.org/#/c/2113

Spun off the original idea of encrypting the RSS contents in the DB, into a separate bug: https://bugs.launchpad.net/mahara/+bug/1175538