With debug mode on, session token may be logged

[lifepillar]

As far as I understand, \slack register always writes the token in plain text into plugins.var.python.slack.slack_api_token. The token can be subsequently secured as explained in the Readme, but, after that, the token remains fully accessible in plain text in logs/core.weechat.weechatlog and partially accessible in logs/python.slack.<some>-workspace.weechatlog.

The Readme should instruct the user to delete the logs after securing the token. Even better, though, would be if wee-slack (or WeeChat?) didn't log any sensitive information to begin with.

Edit: the session token is not logged by default (good!). It is logged when debug mode is on and the debug level is low enough.

[trygveaa]

Hm, it's not printing the token in the buffer or logs for me. After registering and reloading it just says:

12:38 Success! Added team "<team_name>"
12:38 Please reload wee-slack with: /python reload slack
12:38 If you want to add another team you can repeat this process from step 1 before reloading wee-slack.
12:40 python: unloading script "slack"
12:40 python: script "slack" unloaded
12:40 python: loading script "/home/trygve/dev/wee-slack/wee_slack.py"
12:40 python: registered script "slack", version 2.8.0 (Extends weechat for typing notification/search/etc on slack.com)
12:40 Connecting to 1 slack team.
12:40 Connected to Slack team <team_name> (<team_domain>) with username trygveaa

What does it say for you?

I agree that it would be better to support secure variables in the register command so it wasn't stored in plain text in plugins.var.python.slack.slack_api_token though.

[lifepillar]

I see. The token is not logged by default. It is logged if debug mode is on at a low level (I have tried with level 0). So, I guess this is by design (although I'd rather not log sensitive info under any circumstances…). I have edited the issue accordingly.

it would be better to support secure variables in the register command

Yes, please!

[trygveaa]

Even with debug_level at 0 and debug_mode to true it's not logging the tokens here. The only place it's printed is in the slack-debug buffer, but that buffer is not logged.

Can you post what it logs for you (with the tokens censored)?

[lifepillar]

Ah, it's only when I set plugins.var.python.slack.slack_api_token manually that the change gets logged. I think this can be closed then.

[trygveaa]

Right if you set it manually as described in the readme, without using /secure, it will be printed. I've updated the readme to include the /mute command so it's not printed.