[open-ils-commits] [GIT] Evergreen ILS branch rel_2_3 updated. 197e2517391f86b5319ad149e1b1bafc10a7e186
Evergreen Git
git at git.evergreen-ils.org
Thu Nov 8 13:00:25 EST 2012
This is an automated email from the git hooks/post-receive script. It was
generated because a ref change was pushed to the repository containing
the project "Evergreen ILS".
The branch, rel_2_3 has been updated
via 197e2517391f86b5319ad149e1b1bafc10a7e186 (commit)
via e15c45f422f3f90556bc00839e03b569874a5f81 (commit)
via e643b9bbfbede6daaf571e082929d96a32971b58 (commit)
from 3977a280bc7cb27e16ac890b02b68ac043c94d13 (commit)
Those revisions listed above that are new to this repository have
not appeared on any other notification email; so we list those
revisions in full, below.
- Log -----------------------------------------------------------------
commit 197e2517391f86b5319ad149e1b1bafc10a7e186
Author: Bill Erickson <berick at esilibrary.com>
Date: Fri Nov 2 15:28:27 2012 -0400
CStoreEditor auto-activity log redaction
CStoreEditor logs all update calls to the activity log as key/value
pairs on the updated object. Avoid loging key/value pairs for objects
when the API call being relayed by CStoreEditor is on the list of
log-protect API calls. Instead, log "**DETAILS REDACTED**".
Signed-off-by: Bill Erickson <berick at esilibrary.com>
Signed-off-by: Dan Scott <dscott at laurentian.ca>
diff --git a/Open-ILS/src/perlmods/lib/OpenILS/Utils/CStoreEditor.pm b/Open-ILS/src/perlmods/lib/OpenILS/Utils/CStoreEditor.pm
index 51854e3..23559e0 100644
--- a/Open-ILS/src/perlmods/lib/OpenILS/Utils/CStoreEditor.pm
+++ b/Open-ILS/src/perlmods/lib/OpenILS/Utils/CStoreEditor.pm
@@ -1,6 +1,7 @@
use strict; use warnings;
package OpenILS::Utils::CStoreEditor;
use OpenILS::Application::AppUtils;
+use OpenSRF::Application;
use OpenSRF::AppSession;
use OpenSRF::EX qw(:try);
use OpenILS::Utils::Fieldmapper;
@@ -637,9 +638,25 @@ sub _checkperm {
# Logs update actions to the activity log
# -----------------------------------------------------------------------------
sub log_activity {
- my( $self, $type, $action, $arg ) = @_;
+ my( $self, $method, $type, $action, $arg ) = @_;
my $str = "$type.$action";
- $str .= _prop_string($arg);
+
+ if ($arg) {
+
+ my $redact = $OpenSRF::Application::shared_conf->shared->log_protect;
+ if (ref($redact) eq 'ARRAY' and grep { $method =~ /^$_/ } @{$redact}) {
+
+ # when API calls are marked as log-protect, avoid
+ # dumping the param object to the activity log.
+ $str .= " **DETAILS REDACTED**";
+
+ } else {
+
+ $str .= _prop_string($arg);
+ }
+ }
+
+
$self->log(A, $str);
}
@@ -760,7 +777,7 @@ sub runmethod {
$logger->error("Attempt to update DB while not in a transaction : $method");
throw OpenSRF::EX::ERROR ("Attempt to update DB while not in a transaction : $method");
}
- $self->log_activity($type, $action, $arg);
+ $self->log_activity($method, $type, $action, $arg);
}
if($$options{checkperm}) {
commit e15c45f422f3f90556bc00839e03b569874a5f81
Author: Dan Scott <dscott at laurentian.ca>
Date: Mon Nov 5 22:14:34 2012 -0500
Document log redaction XML chunk for opensrf_core.xml
Based on Bill Erickson's original version.
Signed-off-by: Dan Scott <dscott at laurentian.ca>
Signed-off-by: Bill Erickson <berick at esilibrary.com>
diff --git a/docs/RELEASE_NOTES_2_3.txt b/docs/RELEASE_NOTES_2_3.txt
index 4d81226..b8fc6be 100644
--- a/docs/RELEASE_NOTES_2_3.txt
+++ b/docs/RELEASE_NOTES_2_3.txt
@@ -6,7 +6,32 @@ Release notes
Upgrade notes
-------------
-Coming Soon.
+Log Protect (redaction)
+~~~~~~~~~~~~~~~~~~~~~~~
+To prevent sensitive information such as passwords from being logged
+in general activity logs, add the following XML chunk to the bottom of
+`opensrf_core.xml`, just inside the `<config>` section:
+
+[source, xml]
+----------------------------------------------------------------
+ ...
+ </routers>
+ <shared> <!-- new block starts here -->
+ <log_protect>
+ <match_string>open-ils.auth.authenticate.verify</match_string>
+ <match_string>open-ils.auth.authenticate.complete</match_string>
+ <match_string>open-ils.auth_proxy.login</match_string>
+ <match_string>open-ils.actor.user.password</match_string>
+ <match_string>open-ils.actor.user.username</match_string>
+ <match_string>open-ils.actor.user.email</match_string>
+ <match_string>open-ils.actor.patron.update</match_string>
+ <match_string>open-ils.cstore.direct.actor.user.create</match_string>
+ <match_string>open-ils.cstore.direct.actor.user.update</match_string>
+ <match_string>open-ils.cstore.direct.actor.user.delete</match_string>
+ </log_protect>
+ </shared> <!-- new block ends here -->
+</config>
+----------------------------------------------------------------
New features
------------
commit e643b9bbfbede6daaf571e082929d96a32971b58
Author: Bill Erickson <berick at esilibrary.com>
Date: Wed Oct 31 09:00:19 2012 -0400
Add sample log redaction config to EG opensrf_core
Redact parameter logging for the following API calls:
Login:
open-ils.auth.authenticate.verify
open-ils.auth.authenticate.complete
open-ils.auth_proxy.login
User updates:
open-ils.actor.user.password
open-ils.actor.user.username
open-ils.actor.user.email
open-ils.actor.patron.update
open-ils.cstore.direct.actor.user.create
open-ils.cstore.direct.actor.user.update
open-ils.cstore.direct.actor.user.delete
Signed-off-by: Bill Erickson <berick at esilibrary.com>
Signed-off-by: Dan Scott <dscott at laurentian.ca>
diff --git a/Open-ILS/examples/opensrf_core.xml.example b/Open-ILS/examples/opensrf_core.xml.example
index 440bd8b..7bc022f 100644
--- a/Open-ILS/examples/opensrf_core.xml.example
+++ b/Open-ILS/examples/opensrf_core.xml.example
@@ -170,4 +170,22 @@ Example OpenSRF bootstrap configuration file for Evergreen
</router>
</routers>
<!-- ======================================================================================== -->
+
+ <!-- Any methods which match any of these match_string node values will
+ have their params redacted from lower-level input logging.
+ Adjust these examples as needed. -->
+ <shared>
+ <log_protect>
+ <match_string>open-ils.auth.authenticate.verify</match_string>
+ <match_string>open-ils.auth.authenticate.complete</match_string>
+ <match_string>open-ils.auth_proxy.login</match_string>
+ <match_string>open-ils.actor.user.password</match_string>
+ <match_string>open-ils.actor.user.username</match_string>
+ <match_string>open-ils.actor.user.email</match_string>
+ <match_string>open-ils.actor.patron.update</match_string>
+ <match_string>open-ils.cstore.direct.actor.user.create</match_string>
+ <match_string>open-ils.cstore.direct.actor.user.update</match_string>
+ <match_string>open-ils.cstore.direct.actor.user.delete</match_string>
+ </log_protect>
+ </shared>
</config>
-----------------------------------------------------------------------
Summary of changes:
Open-ILS/examples/opensrf_core.xml.example | 18 +++++++++++++
.../src/perlmods/lib/OpenILS/Utils/CStoreEditor.pm | 23 ++++++++++++++--
docs/RELEASE_NOTES_2_3.txt | 27 +++++++++++++++++++-
3 files changed, 64 insertions(+), 4 deletions(-)
hooks/post-receive
--
Evergreen ILS
More information about the open-ils-commits
mailing list