DEBUG=auth writes password to logs in cleartext

[goekce]

Steps:

1) activate DEBUG=auth in /etc/default/xpra
2) start proxy sudo systemctl start xpra
3) login using connect.html
4) journalctl -u xpra you will see your password in cleartext

Is this a feature or a bug?

---

Note: To clear all your logs (and not only the archived ones):

1) sudo journalctl --rotate -u xpra # archives all the logs
2) sudo journalctl --vacuum-time=1s -u xpra

[Antoine Martin]

What is the exact log message containing the password?

[goekce]

authenticator[0]=PAM, requires-challenge=True, challenge-sent=True
combined salt(...)
authenticate_check(************, '...') xor('...')=b'...cleartextpassword...'

[Antoine Martin]

This debug line was added in r18695 at the same time as kerberos and gss auth modules.
r28118 removes the password from the output.

[migration script]

this ticket has been moved to: ​https://github.com/Xpra-org/xpra/issues/2973