From c2136d616576a2ff9f36f477870ba32317ac666a Mon Sep 17 00:00:00 2001
From: Urban Müller
Date: Thu, 25 Apr 2024 18:54:37 +0200
Subject: apply password hiding in both json and var_dump format

---
 it.class | 6 ++++--
 1 file changed, 4 insertions(+), 2 deletions(-)

diff --git a/it.class b/it.class
index d75f9a0..12c4176 100644
--- a/it.class
+++ b/it.class
@@ -287,7 +287,7 @@ static function error($p = array(), $extra = null)
 
 		if ($sendmail || EDC('verboseerrors')) # we're mailing: send maximum info
 		{
-			$p['title'] = it::replace(['alert:|server:|^: "' => "", '"(pw|passw|password\d*|secret)": *"[^"]*"' => '"$1": "*******"'], "$service: " . $p['title']) . " (via " . getenv('HOSTNAME') . ")";
+			$p['title'] = it::replace(['alert:|server:|^: "' => "", '(pw|passw|password\d*|secret)(=)[^&\s]*' => '$1$2*****'], "$service: " . $p['title']) . " (via " . getenv('HOSTNAME') . ")";
 
 			if (!$p['omitdebuginfo'])
 			{
@@ -307,7 +307,9 @@ static function error($p = array(), $extra = null)
 				$body .= $_FILES      ? "\$_FILES:  " . it::json_encode($_FILES, ['pretty' => true]) . "\n" : "";
 				$body .= "Processes:\n" . it::exec('ps auxf | egrep -v "rotatelogs|getbanner|logaction|httpd|systemd|sd-pam"|egrep "^www|^cron"') . "\n";
 				$body .= $longstack  ? "Full stack: "     . "$longstack\n" : "";
-				$body  = it::replace(['"(pw|passw|password\d*|secret)": *"[^"]*"' => '"$1": "*******"'], $body, array('utf8' => false));
+
+				$body  = it::replace(['(pw|passw|password\d*|secret)(\' => |\] => |=)[^&\s]*' => '$1$2********'], $body, ['utf8' => false]);
+				$body  = it::replace(['"(pw|passw|password\d*|secret)": *"[^"]*"' => '"$1": "*******"'], $body, ['utf8' => false]);
 			}
 
 			$type = ($p['fatal'] ? (it::is_live() ? "FATAL: " : "Fatal: ") : "Error: ");
-- 
cgit v1.2.3