Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Hide sensitive information by config #1453

Merged
merged 2 commits into from
Feb 9, 2024
Merged

Conversation

erikn69
Copy link
Contributor

@erikn69 erikn69 commented Sep 7, 2023

#1452 shows a security problem on debugbar files, this PR offer posibility of hide data by config, sometimes can be used not default keys like pass, token, or others
Only request_request.password is hidden from request_request

if (isset($data['request_request']['password'])) {
$data['request_request']['password'] = '******';
}

CC: @barryvdh

UPDATE: Now it hide keys on clockwork too, also it hide authorization token(security fix)

@oprudkyi
Copy link
Contributor

Hi @barryvdh
could you please take a look at this PR
it would be great to have configurable list of hidden keys in some scenarios (multiple qa, non-standard keys)

@oprudkyi
Copy link
Contributor

Hi @barryvdh

is anything can be done here to move it forward ?

@oprudkyi
Copy link
Contributor

Hi @erikn69
also, probably worth to add the same support into src/Support/Clockwork/ClockworkCollector.php
it includes the same data - cookies, headers etc

@erikn69
Copy link
Contributor Author

erikn69 commented Oct 19, 2023

also, probably worth to add the same support into src/Support/Clockwork/ClockworkCollector.php

@oprudkyi you are right, but I don't know if this PR is going to be merged, anyway I'm going to try

@barryvdh barryvdh merged commit 57f5263 into barryvdh:master Feb 9, 2024
13 checks passed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

3 participants