[open-ils-commits] [GIT] Evergreen ILS branch master updated. 84c5f85907c823af8a8caf70e3f7dce3b005e86a
Evergreen Git
git at git.evergreen-ils.org
Thu Nov 8 12:59:01 EST 2012
This is an automated email from the git hooks/post-receive script. It was
generated because a ref change was pushed to the repository containing
the project "Evergreen ILS".
The branch, master has been updated
via 84c5f85907c823af8a8caf70e3f7dce3b005e86a (commit)
via 39f558e3c81d4b9551b527bd5af56ab3666cc7e4 (commit)
via 519e8f77a9b967c5428235b49f46059779c357e8 (commit)
from 769a42183480e0ac3e7944816c89f7539660abd0 (commit)
Those revisions listed above that are new to this repository have
not appeared on any other notification email; so we list those
revisions in full, below.
- Log -----------------------------------------------------------------
commit 84c5f85907c823af8a8caf70e3f7dce3b005e86a
Author: Bill Erickson <berick at esilibrary.com>
Date: Fri Nov 2 15:28:27 2012 -0400
CStoreEditor auto-activity log redaction
CStoreEditor logs all update calls to the activity log as key/value
pairs on the updated object. Avoid loging key/value pairs for objects
when the API call being relayed by CStoreEditor is on the list of
log-protect API calls. Instead, log "**DETAILS REDACTED**".
Signed-off-by: Bill Erickson <berick at esilibrary.com>
Signed-off-by: Dan Scott <dscott at laurentian.ca>
diff --git a/Open-ILS/src/perlmods/lib/OpenILS/Utils/CStoreEditor.pm b/Open-ILS/src/perlmods/lib/OpenILS/Utils/CStoreEditor.pm
index 51854e3..23559e0 100644
--- a/Open-ILS/src/perlmods/lib/OpenILS/Utils/CStoreEditor.pm
+++ b/Open-ILS/src/perlmods/lib/OpenILS/Utils/CStoreEditor.pm
@@ -1,6 +1,7 @@
use strict; use warnings;
package OpenILS::Utils::CStoreEditor;
use OpenILS::Application::AppUtils;
+use OpenSRF::Application;
use OpenSRF::AppSession;
use OpenSRF::EX qw(:try);
use OpenILS::Utils::Fieldmapper;
@@ -637,9 +638,25 @@ sub _checkperm {
# Logs update actions to the activity log
# -----------------------------------------------------------------------------
sub log_activity {
- my( $self, $type, $action, $arg ) = @_;
+ my( $self, $method, $type, $action, $arg ) = @_;
my $str = "$type.$action";
- $str .= _prop_string($arg);
+
+ if ($arg) {
+
+ my $redact = $OpenSRF::Application::shared_conf->shared->log_protect;
+ if (ref($redact) eq 'ARRAY' and grep { $method =~ /^$_/ } @{$redact}) {
+
+ # when API calls are marked as log-protect, avoid
+ # dumping the param object to the activity log.
+ $str .= " **DETAILS REDACTED**";
+
+ } else {
+
+ $str .= _prop_string($arg);
+ }
+ }
+
+
$self->log(A, $str);
}
@@ -760,7 +777,7 @@ sub runmethod {
$logger->error("Attempt to update DB while not in a transaction : $method");
throw OpenSRF::EX::ERROR ("Attempt to update DB while not in a transaction : $method");
}
- $self->log_activity($type, $action, $arg);
+ $self->log_activity($method, $type, $action, $arg);
}
if($$options{checkperm}) {
commit 39f558e3c81d4b9551b527bd5af56ab3666cc7e4
Author: Dan Scott <dscott at laurentian.ca>
Date: Mon Nov 5 22:14:34 2012 -0500
Document log redaction XML chunk for opensrf_core.xml
Based on Bill Erickson's original version.
Signed-off-by: Dan Scott <dscott at laurentian.ca>
Signed-off-by: Bill Erickson <berick at esilibrary.com>
diff --git a/docs/RELEASE_NOTES_2_3.txt b/docs/RELEASE_NOTES_2_3.txt
index 4d81226..b8fc6be 100644
--- a/docs/RELEASE_NOTES_2_3.txt
+++ b/docs/RELEASE_NOTES_2_3.txt
@@ -6,7 +6,32 @@ Release notes
Upgrade notes
-------------
-Coming Soon.
+Log Protect (redaction)
+~~~~~~~~~~~~~~~~~~~~~~~
+To prevent sensitive information such as passwords from being logged
+in general activity logs, add the following XML chunk to the bottom of
+`opensrf_core.xml`, just inside the `<config>` section:
+
+[source, xml]
+----------------------------------------------------------------
+ ...
+ </routers>
+ <shared> <!-- new block starts here -->
+ <log_protect>
+ <match_string>open-ils.auth.authenticate.verify</match_string>
+ <match_string>open-ils.auth.authenticate.complete</match_string>
+ <match_string>open-ils.auth_proxy.login</match_string>
+ <match_string>open-ils.actor.user.password</match_string>
+ <match_string>open-ils.actor.user.username</match_string>
+ <match_string>open-ils.actor.user.email</match_string>
+ <match_string>open-ils.actor.patron.update</match_string>
+ <match_string>open-ils.cstore.direct.actor.user.create</match_string>
+ <match_string>open-ils.cstore.direct.actor.user.update</match_string>
+ <match_string>open-ils.cstore.direct.actor.user.delete</match_string>
+ </log_protect>
+ </shared> <!-- new block ends here -->
+</config>
+----------------------------------------------------------------
New features
------------
commit 519e8f77a9b967c5428235b49f46059779c357e8
Author: Bill Erickson <berick at esilibrary.com>
Date: Wed Oct 31 09:00:19 2012 -0400
Add sample log redaction config to EG opensrf_core
Redact parameter logging for the following API calls:
Login:
open-ils.auth.authenticate.verify
open-ils.auth.authenticate.complete
open-ils.auth_proxy.login
User updates:
open-ils.actor.user.password
open-ils.actor.user.username
open-ils.actor.user.email
open-ils.actor.patron.update
open-ils.cstore.direct.actor.user.create
open-ils.cstore.direct.actor.user.update
open-ils.cstore.direct.actor.user.delete
Signed-off-by: Bill Erickson <berick at esilibrary.com>
Signed-off-by: Dan Scott <dscott at laurentian.ca>
diff --git a/Open-ILS/examples/opensrf_core.xml.example b/Open-ILS/examples/opensrf_core.xml.example
index 440bd8b..7bc022f 100644
--- a/Open-ILS/examples/opensrf_core.xml.example
+++ b/Open-ILS/examples/opensrf_core.xml.example
@@ -170,4 +170,22 @@ Example OpenSRF bootstrap configuration file for Evergreen
</router>
</routers>
<!-- ======================================================================================== -->
+
+ <!-- Any methods which match any of these match_string node values will
+ have their params redacted from lower-level input logging.
+ Adjust these examples as needed. -->
+ <shared>
+ <log_protect>
+ <match_string>open-ils.auth.authenticate.verify</match_string>
+ <match_string>open-ils.auth.authenticate.complete</match_string>
+ <match_string>open-ils.auth_proxy.login</match_string>
+ <match_string>open-ils.actor.user.password</match_string>
+ <match_string>open-ils.actor.user.username</match_string>
+ <match_string>open-ils.actor.user.email</match_string>
+ <match_string>open-ils.actor.patron.update</match_string>
+ <match_string>open-ils.cstore.direct.actor.user.create</match_string>
+ <match_string>open-ils.cstore.direct.actor.user.update</match_string>
+ <match_string>open-ils.cstore.direct.actor.user.delete</match_string>
+ </log_protect>
+ </shared>
</config>
-----------------------------------------------------------------------
Summary of changes:
Open-ILS/examples/opensrf_core.xml.example | 18 +++++++++++++
.../src/perlmods/lib/OpenILS/Utils/CStoreEditor.pm | 23 ++++++++++++++--
docs/RELEASE_NOTES_2_3.txt | 27 +++++++++++++++++++-
3 files changed, 64 insertions(+), 4 deletions(-)
hooks/post-receive
--
Evergreen ILS
More information about the open-ils-commits
mailing list