Some fields contain sensitive data (eg API keys etc) and the values should not be recorded in the log.
But log should contain which user has updated the key and when.
Log record now:
Configuration changed: hubspot_api.settings.access_key changed from 123-124-125 to 222-444-555 at 1748009132
Add a configuration setting and text field on settings form (similar to "Configuration entity names to ignore") to not log config property value.
Proposed log record:
Configuration changed: hubspot_api.settings.access_key changed by user j.smith at 1748009132
- update settings to include new property "Do not log value of config property"
- update config settings form
- update logging logic
- settings form to include a new text field
- none
- update settings to include new property "Do not log value of config property"
This will help to prevent any leaks of API keys and other sensitive data.
| Comment | File | Size | Author |
|---|---|---|---|
| #3 | add-sensitive-config-filter-3.patch | 19.95 KB | nagy.balint |
Show commandsStart within a Git clone of the project using the version control instructions.
Or, if you do not have SSH keys set up on git.drupalcode.org:
changes
Comments
Comment #2
nagy.balint commentedI just think that maybe this should be automatic instead.
Like we can have a list of common config names that are API key and such related. As I think in most cases we would like to not log these in the module.
And then this could also work inside the diff, like showing the diff but one part of the diff is a key then that would be ommitted.
And then we can have a checkbox which can turn this filter off, but with a note about security.
Comment #3
nagy.balint commentedI would try something like this
Comment #4
jannakha commented@nagy.balint thanks for the patch.
any chance for MR? it'll speed up testing and review process.
Comment #6
nagy.balint commentedDone
Comment #8
nagy.balint commented