QVD files store connection string in plain text!

[pljsoftware]

Hi all!

I have noticed a very strange thing using QVD files... Inside the file, I can read in plain text my QlikView script, including the connection string with password!

How it can be possible?

[pljsoftware]

Hi there,

I use QV 10 SR3, and when I open QVD file I found all my script and the password in plain text.

A few days ago I installed the version  QV 11 RC and after I removed it and reinstalled QV 10 SR3, can this make me this problem?

Regards

Luca Jonathan Panetta

PLJ Software

[#3]

I just tried it and I am speechless. I cannot believe such a disaster, this is very serious, I hope QT comes with a patch right away.

Nice discovery Luca.

Regards

[isaiah82]

In every headache there is a blessing ~ I just used this to get back some "lost" credentials from a scrambled connection string that were never documented.  For clarification, if there cred's are scrambled in your script, they are stored unscrambled in the qvd header.

One more reason not to keep fighting integrated authentication I suppose 😃

[rbecher]

Thanks, good to know!

I found also an unscrambled password (was scrambled in the script) at the end of the QVW created with QV10 SR3 in the xml metadata part:

<LineageInfo>

  <Discriminator>...

This is an unbelievable risky major bug!

- Ralf

[Anonymous]

Wow!   We have the same issue in QV10SR3.  This doesn't thrill our SA's at all.  Good thing our QVD's are locked down.

We had a good chuckle from Isiah Weed's post.   Always a positive somewhere!!!!

[rbecher]

This seems to be fixed in QV10 SR4. I cannot reproduce it.

- Ralf

[pljsoftware]

Sorry Ralf,

I have try my test file with QV 10 SR4 9274 but the problem subsist.

I tried it with QV 9 SR7 7778 and it's all ok.

My script is:

OLEDB CONNECT TO .... //Connection String

CustomerSellers:

LOAD *;

SQL SELECT top 1          c.CardCode FROM OCRD c;

DISCONNECT;

X:

load * Inline

[x,y

1,2];

STORE * from X into X.qvd;

EXIT Script;

Regards

Luca Jonathan Panetta

PLJ Software

[rbecher]

I created a new QVW which stores some QVD files with QV10 SR4. It still stores the connect string but without the password.

So, I think this is not a problem anymore but of course maybe with old files ..

- Ralf

[pljsoftware]

Ok Ralf,

I tried too and the Password there isn't but why I have my script and my connection string in a QVD if I want only to save the data of my table?

In QV 9 SR7 7778 I have only my data.

I wrote to the support too.

Regards

Luca Jonathan Panetta

PLJ Software

[Clever_Anjos]

It´s a knowed bug in 10SR2 and 10SR3

Fixed on 10SR4