From 88cef74ff059c85e15ca5f9f9dff7c874780be58 Mon Sep 17 00:00:00 2001
From: Urban Müller
Date: Fri, 4 Oct 2024 16:27:15 +0200
Subject: avoid leaking API keys in err messages

---
 it.class | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

(limited to 'it.class')

diff --git a/it.class b/it.class
index 74367d2..eba5aa6 100644
--- a/it.class
+++ b/it.class
@@ -287,7 +287,7 @@ static function error($p = array(), $extra = null)
 
 		if ($sendmail || EDC('verboseerrors')) # we're mailing: send maximum info
 		{
-			$p['title'] = it::replace(['alert:|server:|^: "' => "", '(pw|passw|password\d*|secret)(=)[^&\s]*' => '$1$2*****'], "$service: " . $p['title']) . " (via " . getenv('HOSTNAME') . ")";
+			$p['title'] = it::replace(['alert:|server:|^: "' => "", '(pw|passw|password\d*|secret|api.?key)(=)[^&\s]*' => '$1$2*****'], "$service: " . $p['title']) . " (via " . getenv('HOSTNAME') . ")";
 
 			if (!$p['omitdebuginfo'])
 			{
@@ -308,8 +308,8 @@ static function error($p = array(), $extra = null)
 				$body .= "Processes:\n" . it::exec('ps auxf | egrep -v "rotatelogs|getbanner|logaction|httpd|systemd|sd-pam"|egrep "^www|^cron"') . "\n";
 				$body .= $longstack  ? "Full stack: "     . "$longstack\n" : "";
 
-				$body  = it::replace(['(pw|passw|password\d*|secret)(\' => |\] => |=)[^&\s]*' => '$1$2********'], $body, ['utf8' => false]);
-				$body  = it::replace(['"(pw|passw|password\d*|secret)": *"[^"]*"' => '"$1": "*******"'], $body, ['utf8' => false]);
+				$body  = it::replace(['(pw|passw|password\d*|secret|api.?key)(\' => |\] => |=)[^&\s]*' => '$1$2********'], $body, ['utf8' => false]);
+				$body  = it::replace(['"(pw|passw|password\d*|secret|api.?key)": *"[^"]*"' => '"$1": "*******"'], $body, ['utf8' => false]);
 			}
 
 			$type = ($p['fatal'] ? (it::is_live() ? "FATAL: " : "Fatal: ") : "Error: ");
-- 
cgit v1.2.3