Uploaded image for project: 'i2b2 Core Software'
  1. i2b2 Core Software
  2. CORE-308

Full Request XML message is stored in the QT_PDO_QUERY_MASTER table

    XMLWordPrintable

Details

    • Bug
    • Status: Resolved
    • Major
    • Resolution: Fixed
    • 1.7.10
    • 1.7.11
    • None
    • None
    • Rank:
      0|i003zj:
    • All databases
    • All Web Browsers

    Description

      In the QT_PDO_QUERY_MASTER table, the full request XML message is stored in the REQUEST_XML column. This includes the message header, which means we could store passwords. This would only be a problem if sites have configured their system to display passwords instead of session keys (tokens).

      The QT_QUERY_MASTER table has a similar column that is also called REQUEST_XML. The <query_definition> is the only section of the request message that is stored in the REQUEST_XML Column.

      In the QT_PDO_QUERY_MASTER table a modified version of the Request message should be stored the same as we do in the QT_QUERY_MASTER table. By not storing the <message_header> we do not run the risk of storing and potentially exposing passwords.

      Attachments

        Activity

          People

            rm302 Reeta Metta
            jmd86 Janice Donahoe
            Votes:
            0 Vote for this issue
            Watchers:
            1 Start watching this issue

            Dates

              Created:
              Updated:
              Resolved: