Hacker News Reader

This was reported on Sep 06 2011... a suggested fix in the ticket was "should strip from history like .auth()".

Has it been fixed? What is the implications of having it in the console history?

I tested some stuff with MongoDB about a month ago and I did notice the shell-history-thing with addUser at that time.

Edit: It is not fixed in 2.0.2 at least. (Tested now)

Edit: Looks like it's available only in the local user history of the machine you perform the addUser.

So I guess the risk is low.

MySQL has had this same problem forever. This isn't something "new". Its stored in the local users .mysql_history

Thanks for bringing this to our attention. It has just been fixed in master.

Db.addUser() appears in shell history, with cleartext passwords - MongoDB