fix misstyped passwords leaked in log files with redmine auth provider

diff --git a/src/main/java/com/gitblit/auth/RedmineAuthProvider.java b/src/main/java/com/gitblit/auth/RedmineAuthProvider.java
index 7e957ecbbc91b668f1051b7594c5741cd4f7c50d..e505a54d37dd6cf0b26e1698fcbc81e73a960bb2 100644 (file)
--- a/src/main/java/com/gitblit/auth/RedmineAuthProvider.java
+++ b/src/main/java/com/gitblit/auth/RedmineAuthProvider.java
@@ -153,15 +153,16 @@ public class RedmineAuthProvider extends UsernamePasswordAuthenticationProvider
         if (!url.endsWith("/")) {
                url = url.concat("/");
         }
+        String apiUrl = url + "users/current.json";
+        
         HttpURLConnection http;
         if (username == null) {
                // apikey authentication
                String apiKey = String.valueOf(password);
-               String apiUrl = url + "users/current.json?key=" + apiKey;
                http = (HttpURLConnection) ConnectionUtils.openConnection(apiUrl, null, null);
+            http.addRequestProperty("X-Redmine-API-Key", apiKey);
         } else {
                // username/password BASIC authentication
-               String apiUrl = url + "users/current.json";
                http = (HttpURLConnection) ConnectionUtils.openConnection(apiUrl, username, password);
         }
         http.setRequestMethod("GET");