Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

passwords not hidden in logs for get_user_from_param #3453

Closed
plettich opened this issue Jan 10, 2023 · 1 comment
Closed

passwords not hidden in logs for get_user_from_param #3453

plettich opened this issue Jan 10, 2023 · 1 comment
Assignees
@plettich
Labels
Status: Waiting for merge into master Issue is resolved. Needs to be merged from a feature branch to master
Projects
privacyIDEA 3.8
Milestone
3.8 patches

Comments

@plettich
Copy link
Member

The get_user_from_param() function receives a dictionary with all the request parameter (including pass or password).
Since it is customary to hide passwords in the debug logs, we should add the hide_args_keywords parameter to the log_with decorator.
@cornelinux cornelinux added this to To do in privacyIDEA 3.8 via automation Jan 12, 2023
@cornelinux cornelinux added this to the 3.8 patches milestone Jan 12, 2023
plettich added a commit that referenced this issue Jan 16, 2023
@plettich
Hide passwords in debug logs
b76d253 
Using keywords to hide passwords in debug log for
`get_user_from_param()`

Working on: #3453
@plettich plettich mentioned this issue Jan 16, 2023
Merged
@plettich plettich moved this from To do to In progress in privacyIDEA 3.8 Jan 16, 2023
@plettich plettich added the Status: Waiting for merge into master Issue is resolved. Needs to be merged from a feature branch to master label Jan 16, 2023
plettich added a commit that referenced this issue Jan 20, 2023
@plettich
Hide passwords in debug logs
630066e 
Using keywords to hide passwords in debug log for
`get_user_from_param()`, `check_token_list()` and `set_otpkey()`.
Fix the `log_with` decorator to correctly print out all parameters.

Working on: #3453
@cornelinux cornelinux moved this from In progress to Nearly Done in privacyIDEA 3.8 Jan 20, 2023
jona-samuel pushed a commit that referenced this issue Jan 26, 2023
@plettich
Hide passwords in debug logs
16123d8 
Using keywords to hide passwords in debug log for
`get_user_from_param()`, `check_token_list()` and `set_otpkey()`.
Fix the `log_with` decorator to correctly print out all parameters.

Working on: #3453
@cornelinux cornelinux moved this from Nearly Done to Done in privacyIDEA 3.8 Jan 26, 2023
@plettich
Copy link
Member Author

plettich commented Feb 9, 2023

merged into master here 66d4a7b

@plettich plettich closed this as completed Feb 9, 2023
privacyIDEA 3.8 automation moved this from Done to Nearly Done Feb 9, 2023
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Assignees

@plettich plettich

Labels
Status: Waiting for merge into master Issue is resolved. Needs to be merged from a feature branch to master
Projects
privacyIDEA 3.8
  
Nearly Done
Milestone
3.8 patches
Development

No branches or pull requests
2 participants
@cornelinux @plettich