From 09b0e6e388dc802b090ce016838bf0ef4ccb4874 Mon Sep 17 00:00:00 2001 From: "Haneysmith, Nathan" Date: Fri, 15 May 2015 11:11:02 -0700 Subject: [PATCH] Addresses #1853, redact session provider secrets In cases where a database is used for session storage, redact the session_provider config value. I assumed "@" as the marker for a database vs file/memory. --- pkg/api/admin_settings.go | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/pkg/api/admin_settings.go b/pkg/api/admin_settings.go index 21615219acd..71ed229bba7 100644 --- a/pkg/api/admin_settings.go +++ b/pkg/api/admin_settings.go @@ -17,7 +17,7 @@ func AdminGetSettings(c *middleware.Context) { for _, key := range section.Keys() { keyName := key.Name() value := key.Value() - if strings.Contains(keyName, "secret") || strings.Contains(keyName, "password") { + if strings.Contains(keyName, "secret") || strings.Contains(keyName, "password") || (strings.Contains(keyName, "provider_config") && strings.Contains(value, "@")) { value = "************" }