wbrawner/server
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

Don't log passwords on dav exceptions

Browse source 
Signed-off-by: Joas Schilling <coding@schilljs.com>
This commit is contained in:
Joas Schilling 2017-06-29 11:43:32 +02:00
parent 045d04332e
commit b27819785e
No known key found for this signature in database
GPG key ID: E166FD8976B3BAC8
3 changed files with 17 additions and 29 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

25
apps/dav/lib/Connector/Sabre/ExceptionLoggerPlugin.php
View file

@ -94,26 +94,9 @@ class ExceptionLoggerPlugin extends \Sabre\DAV\ServerPlugin {
$level = \OCP\Util::DEBUG;
}
$message = $ex->getMessage();
if ($ex instanceof Exception) {
if (empty($message)) {
$response = new Response($ex->getHTTPCode());
$message = $response->getStatusText();
}
$message = "HTTP/1.1 {$ex->getHTTPCode()} $message";
}
$user = \OC_User::getUser();
$exception = [
'Message' => $message,
'Exception' => $exceptionClass,
'Code' => $ex->getCode(),
'Trace' => $ex->getTraceAsString(),
'File' => $ex->getFile(),
'Line' => $ex->getLine(),
'User' => $user,
];
$this->logger->log($level, 'Exception: ' . json_encode($exception), ['app' => $this->appName]);
$this->logger->logException($ex, [
'app' => $this->appName,
'level' => $level,
]);
}
}

6
apps/dav/tests/unit/Connector/Sabre/ExceptionLoggerPluginTest.php
View file

@ -71,13 +71,13 @@ class ExceptionLoggerPluginTest extends TestCase {
$this->plugin->logException($exception);
$this->assertEquals($expectedLogLevel, $this->logger->level);
$this->assertStringStartsWith('Exception: {"Message":"' . $expectedMessage, $this->logger->message);
$this->assertStringStartsWith('Exception: {"Exception":' . json_encode(get_class($exception)) . ',"Message":"' . $expectedMessage . '",', $this->logger->message);
}
public function providesExceptions() {
return [
[0, 'HTTP\/1.1 404 Not Found', new NotFound()],
[4, 'HTTP\/1.1 400 This path leads to nowhere', new InvalidPath('This path leads to nowhere')]
[0, '', new NotFound()],
[4, 'This path leads to nowhere', new InvalidPath('This path leads to nowhere')]
];
}

15
lib/private/Log.php
View file

@ -305,13 +305,18 @@ class Log implements ILogger {
/**
* Logs an exception very detailed
*
* @param \Exception | \Throwable $exception
* @param \Exception|\Throwable $exception
* @param array $context
* @return void
* @since 8.2.0
*/
public function logException($exception, array $context = array()) {
$exception = array(
$level = Util::ERROR;
if (isset($context['level'])) {
$level = $context['level'];
unset($context['level']);
}
$data = array(
'Exception' => get_class($exception),
'Message' => $exception->getMessage(),
'Code' => $exception->getCode(),
@ -319,10 +324,10 @@ class Log implements ILogger {
'File' => $exception->getFile(),
'Line' => $exception->getLine(),
);
$exception['Trace'] = preg_replace('!(' . implode('|', $this->methodsWithSensitiveParameters) . ')\(.*\)!', '$1(*** sensitive parameters replaced ***)', $exception['Trace']);
$data['Trace'] = preg_replace('!(' . implode('|', $this->methodsWithSensitiveParameters) . ')\(.*\)!', '$1(*** sensitive parameters replaced ***)', $data['Trace']);
$msg = isset($context['message']) ? $context['message'] : 'Exception';
$msg .= ': ' . json_encode($exception);
$this->error($msg, $context);
$msg .= ': ' . json_encode($data);
$this->log($level, $msg, $context);
}
/**