[open-ils-commits] [GIT] Evergreen ILS branch rel_2_1 updated. 11c87c4f6a47bbfdc85640bc9aead9e542ee3aaf

[Evergreen Git]

This is an automated email from the git hooks/post-receive script. It was
generated because a ref change was pushed to the repository containing
the project "Evergreen ILS".

The branch, rel_2_1 has been updated
       via  11c87c4f6a47bbfdc85640bc9aead9e542ee3aaf (commit)
       via  a5fcc2b69f605b21a382ccfdadeb9c40b90ce2fa (commit)
      from  19d53bda570a3eeab65e6d88e4c963b40553986b (commit)

Those revisions listed above that are new to this repository have
not appeared on any other notification email; so we list those
revisions in full, below.

- Log -----------------------------------------------------------------
commit 11c87c4f6a47bbfdc85640bc9aead9e542ee3aaf
Author: Bill Erickson <berick at esilibrary.com>
Date:   Fri Nov 2 15:28:27 2012 -0400

    CStoreEditor auto-activity log redaction
    
    CStoreEditor logs all update calls to the activity log as key/value
    pairs on the updated object.  Avoid loging key/value pairs for objects
    when the API call being relayed by CStoreEditor is on the list of
    log-protect API calls.  Instead, log "**DETAILS REDACTED**".
    
    Signed-off-by: Bill Erickson <berick at esilibrary.com>
    Signed-off-by: Dan Scott <dscott at laurentian.ca>

diff --git a/Open-ILS/src/perlmods/lib/OpenILS/Utils/CStoreEditor.pm b/Open-ILS/src/perlmods/lib/OpenILS/Utils/CStoreEditor.pm
index c137829..48c5d95 100644
--- a/Open-ILS/src/perlmods/lib/OpenILS/Utils/CStoreEditor.pm
+++ b/Open-ILS/src/perlmods/lib/OpenILS/Utils/CStoreEditor.pm
@@ -1,6 +1,7 @@
 use strict; use warnings;
 package OpenILS::Utils::CStoreEditor;
 use OpenILS::Application::AppUtils;
+use OpenSRF::Application;
 use OpenSRF::AppSession;
 use OpenSRF::EX qw(:try);
 use OpenILS::Utils::Fieldmapper;
@@ -610,9 +611,25 @@ sub _checkperm {
 # Logs update actions to the activity log
 # -----------------------------------------------------------------------------
 sub log_activity {
-	my( $self, $type, $action, $arg ) = @_;
+	my( $self, $method, $type, $action, $arg ) = @_;
 	my $str = "$type.$action";
-	$str .= _prop_string($arg);
+
+    if ($arg) {
+
+        my $redact = $OpenSRF::Application::shared_conf->shared->log_protect;
+        if (ref($redact) eq 'ARRAY' and grep { $method =~ /^$_/ } @{$redact}) {
+
+            # when API calls are marked as log-protect, avoid 
+            # dumping the param object to the activity log.
+            $str .= " **DETAILS REDACTED**";
+
+        } else {
+
+            $str .= _prop_string($arg);
+        }
+    }
+
+
 	$self->log(A, $str);
 }
 
@@ -733,7 +750,7 @@ sub runmethod {
 			$logger->error("Attempt to update DB while not in a transaction : $method");
 			throw OpenSRF::EX::ERROR ("Attempt to update DB while not in a transaction : $method");
 		}
-		$self->log_activity($type, $action, $arg);
+		$self->log_activity($method, $type, $action, $arg);
 	}
 
 	if($$options{checkperm}) {

commit a5fcc2b69f605b21a382ccfdadeb9c40b90ce2fa
Author: Bill Erickson <berick at esilibrary.com>
Date:   Wed Oct 31 09:00:19 2012 -0400

    Add sample log redaction config to EG opensrf_core
    
    Redact parameter logging for the following API calls:
    
    Login:
    open-ils.auth.authenticate.verify
    open-ils.auth.authenticate.complete
    open-ils.auth_proxy.login
    
    User updates:
    open-ils.actor.user.password
    open-ils.actor.user.username
    open-ils.actor.user.email
    open-ils.actor.patron.update
    open-ils.cstore.direct.actor.user.create
    open-ils.cstore.direct.actor.user.update
    open-ils.cstore.direct.actor.user.delete
    
    Signed-off-by: Bill Erickson <berick at esilibrary.com>
    Signed-off-by: Dan Scott <dscott at laurentian.ca>

diff --git a/Open-ILS/examples/opensrf_core.xml.example b/Open-ILS/examples/opensrf_core.xml.example
index cebffee..3803775 100644
--- a/Open-ILS/examples/opensrf_core.xml.example
+++ b/Open-ILS/examples/opensrf_core.xml.example
@@ -168,4 +168,22 @@ Example OpenSRF bootstrap configuration file for Evergreen
     </router>
   </routers>
   <!-- ======================================================================================== -->
+
+  <!-- Any methods which match any of these match_string node values will     
+       have their params redacted from lower-level input logging.             
+       Adjust these examples as needed. -->      
+  <shared>
+    <log_protect>
+      <match_string>open-ils.auth.authenticate.verify</match_string>
+      <match_string>open-ils.auth.authenticate.complete</match_string>
+      <match_string>open-ils.auth_proxy.login</match_string>
+      <match_string>open-ils.actor.user.password</match_string>
+      <match_string>open-ils.actor.user.username</match_string>
+      <match_string>open-ils.actor.user.email</match_string>
+      <match_string>open-ils.actor.patron.update</match_string>
+      <match_string>open-ils.cstore.direct.actor.user.create</match_string>
+      <match_string>open-ils.cstore.direct.actor.user.update</match_string>
+      <match_string>open-ils.cstore.direct.actor.user.delete</match_string>
+    </log_protect>
+  </shared>
 </config>

-----------------------------------------------------------------------

Summary of changes:
 Open-ILS/examples/opensrf_core.xml.example         |   18 +++++++++++++++
 .../src/perlmods/lib/OpenILS/Utils/CStoreEditor.pm |   23 +++++++++++++++++--
 2 files changed, 38 insertions(+), 3 deletions(-)


hooks/post-receive
-- 
Evergreen ILS