Details
-
Type:
Sub-task
-
Status: Closed
-
Priority:
Major
-
Resolution: Fixed
-
Affects Version/s: None
-
Fix Version/s: Release Branch 14.12, Release Branch 15.12, Upcoming Release, 16.11.02
-
Component/s: None
-
Labels:None
-
Sprint:Bug Crush Event - 21/2/2015
Description
In UtilHttp.getParameterMap(HttpServletRequest request, Set<? extends String> nameSet, Boolean onlyIncludeOrSkip) method, following line of code prints username and password in logs when verbose is set to true.
if (Debug.verboseOn())
{ Debug.logVerbose("Made Request Parameter Map with [" + paramMap.size() + "] Entries", module); Debug.logVerbose("Request Parameter Map Entries: " + System.getProperty("line.separator") + UtilMisc.printMap(paramMap), module); }
Activity
- All
- Comments
- Work Log
- History
- Activity
- Transitions
Thanks Aditya,
I decided to rather comment out the line which might still be useful in some cases...
Fixed in
trunk r1791346
R16.11 r1791347
R15.12 and 14.12 r1791348
Thanks Jacques 
Removed the line that prints "Request Parameter Map Entries" as it may print username and password entered by user when verbose set to true. It may not be a grave concern for staging environment as verbose are not logged there but it is still unethical to print such details.