2

QGIS is the main GIS application used at my workplace. Access to the plugin repository has recently been removed due to a perceived security risk relating to the way QGIS stores proxy settings, including user passwords, as below (from the QGIS configuration page).

enter image description here

Is there a way to stop QGIS from saving and retaining records of these details, and instead requiring users to enter them each time they access plugin repositories?

3

If this is the issue in qgis where it stores the users network details in text in the registry then yes it is a security issue but only if you are on a secure network like a council government or large developer. Not a problem for most of us though. Qgis really should encrypt this info as that is the basic for most apps. Other posts say they fixed this in 2.12 but that is not correct. Still does it in 2.14. Checked mine just now.

  • Yes, it's a secure network. It would be great if this could be addressed. – SpatialSuccess Mar 17 '16 at 19:47
5

In QGIS 2.14 an authentication system support for the plugin manager has been addded, maybe that's what you're looking for.

You can access the feature by going to Plugins > Manage and install plugins > Settings. When you select a repository you can use the edit button to open its settings, therunder you can find the new entry for authentication.

  • Thanks for your answer. I'm still not entirely sure how this works though. I gather that via the authentication settings you can now set a master password which isn't saved after the session ends. If you need to access repositories via an http proxy due to network setup though, are these settings still saved? Maybe I'm missing something obvious here! – SpatialSuccess Mar 17 '16 at 10:29
  • Unfortunately I also haven't worked with it before since it is a completely new feature of 2.14. Maybe there will be further information about it in the internet in the near future. – TobsenB Mar 17 '16 at 10:36
  • with new qgis auth the only think saved in prj or registry is a unique id used to access credentials in the qgis-auth.db (that is protected by a master pwd). – Luigi Pirelli Mar 20 '16 at 15:17
  • In this moment auth syustem is till not fully integrated with the base qgis network classes (QgsNetworkAccessManager) that can manage also proxy settings... this is a planned work. – Luigi Pirelli Mar 20 '16 at 15:19
1

if your proxy requires authentication and this is the case in most secure networks then you cannot access any internet resources via qgis as the program stores your username and password in plain text which anyone can access. as most secure networks use some form of passthrough authentication for internet access then this username and password will be the same one you probably log onto your work computer with. you might as well write your username and password on a note and stick it on the side of your screen. this has been raised before and there is no interest in providing basic encryption for password storage in qgis. see this post here for some more info on poor password security used by qgis. https://hub.qgis.org/issues/8180 http://lists.osgeo.org/pipermail/qgis-user/2012-February/015555.html

  • "Qgisguru": Are you from my IT department by any chance?? – SpatialSuccess Mar 18 '16 at 6:03
  • if your name is Anthony and you are my husband then yes I am your it department. I work for developers local governments and architects in Canada UK and some others but live in New Zealand. I don't have to worry about the problems you seem to have as my network is 2 computers and a printer. You know you can get your IT people to set up a plugin repository on your own network. Did that for some people here once with the same proxy password problem. it is not very hard and there are instructions on the forums. good luck – qgisguru Mar 18 '16 at 7:30
  • This should be a comment on the other answer, not an answer in itself. – alphabetasoup Mar 18 '16 at 7:36
  • It looks like you have created two accounts. Please merge this one (gis.stackexchange.com/users/69516/qgisguru), with gis.stackexchange.com/users/69466/qgisguru, using these instructions ASAP: gis.stackexchange.com/help/merging-accounts – PolyGeo Mar 18 '16 at 7:56
  • Sorry, wrong person! Looks like a network repository is the only solution for now. Thanks for your input. – SpatialSuccess Mar 18 '16 at 7:56

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.