Expose License Key at rtmedia.io

[MiteshShah]

104.198.7.79 BYPASS [10/Jan/2024:08:43:28 +0000] rtmedia.io "GET /?edd_action=activate_license&license=XXXXXXXXXXXXXXXXX&item_name=rtMedia%20Docs%20and%20Other%20files&url=https://www.inblf.com HTTP/1.1" 200 134 "-" "WordPress/6.4.2; https://example.com"0.254 0.255
104.236.212.59 BYPASS [10/Jan/2024:08:44:12 +0000] rtmedia.io "GET /rt-eddsl-api?rt-eddsl-license-key=XXXXXXXXXXXXXXX HTTP/1.1" 200 330 "-" "GuzzleHttp/7"0.464 0.464

Sending sensitive information (API or License key) in query parameters is generally not recommended for security reasons. URLs are often logged in various places, such as browser history, server logs, and can be exposed in shared links, posing a security risk.

@gagan0123

[Utsav-Ladani]

Hi @MiteshShah

This issue is resolved with this PR. We will add it in the next release.

Thanks

CC: @gagan0123

[MiteshShah]

@Utsav-Ladani I can see PR is merged already.
Do we close this issue if we released a fix already ?

[Utsav-Ladani]

@MiteshShah, the fix has been added in the pre-release branch but has yet to be released.

It is added in milestone v4.6.18. So, we have to keep this PR open until milestone v4.6.18 is released. Will let you know once the plugin is released.

[pavanpatil1]

It is fixed, Hence closing this issue

[MiteshShah]

@pavanpatil1 I can still see the license keys on logs still as on 4th Nov 2024.
cc: @radhe

[krishana7911]

Hi @MiteshShah can you please share recent logs for reference regarding the issue.

[MiteshShah]

@krishana7911 - https://rtcamp.slack.com/archives/CGRL6NAQL/p1730870282131599

[nitun]

@krishana7911 please look into this. Its important task.