[OFBIZ-9310] On setting verbose true, UtilHttp.getParameterMap() method prints username and password in logs

• Type: Sub-task
• Status: Closed
• Priority: Major
• Resolution: Fixed
• Fix Version/s: Release Branch 14.12, Release Branch 15.12, 16.11.02, 17.12.01
• Sprint: Bug Crush Event - 21/2/2015
• Assignee: Jacques Le Roux
• Reporter: Aditya Sharma
• Created: 10/Apr/17 08:02
• Updated: 14/Apr/17 11:46
• Resolved: 14/Apr/17 11:07

Description

In UtilHttp.getParameterMap(HttpServletRequest request, Set<? extends String> nameSet, Boolean onlyIncludeOrSkip) method, following line of code prints username and password in logs when verbose is set to true.

if (Debug.verboseOn())

{ Debug.logVerbose("Made Request Parameter Map with [" + paramMap.size() + "] Entries", module); Debug.logVerbose("Request Parameter Map Entries: " + System.getProperty("line.separator") + UtilMisc.printMap(paramMap), module); }