From 650136070e147f30cea647d1de619ecfa4770b67 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Ya=C4=9F=C4=B1zhan?= <yagizhan49@protonmail.com>
Date: Sun, 23 Apr 2023 22:38:29 +0300
Subject: [PATCH] Redact commonly used credential parameters during logging
 (#1154)

---
 src/library/Box/EventManager.php | 24 ++++++++++++++++++++++++
 1 file changed, 24 insertions(+)

diff --git a/src/library/Box/EventManager.php b/src/library/Box/EventManager.php
index 069535fef..6153b316e 100644
--- a/src/library/Box/EventManager.php
+++ b/src/library/Box/EventManager.php
@@ -15,6 +15,7 @@
 class Box_EventManager implements \Box\InjectionAwareInterface
 {
     protected $di;
+    protected $sensitiveParameters = ['password', 'pass', 'passwd', 'password_confirmation'];
 
     /**
      * @param mixed $di
@@ -44,6 +45,10 @@ class Box_EventManager implements \Box\InjectionAwareInterface
         $subject = $data['subject'] ?? null;
         $params = $data['params'] ?? null;
 
+        if (is_array($params)) {
+            $params = $this->hideSensitiveParameters($params);
+        }
+
         if (BB_DEBUG) {
             $this->di['logger']->debug($event.': '.var_export($params, 1));
         }
@@ -57,6 +62,25 @@ class Box_EventManager implements \Box\InjectionAwareInterface
         return $e->getReturnValue();
     }
 
+    /**
+     * Hide some of the known sensitive parameters.
+     * 
+     * @param array $params
+     * @return array
+     */
+    public function hideSensitiveParameters($params)
+    {
+        if (is_array($params)) {
+            foreach ($params as $key => $value) {
+                if (in_array($key, $this->sensitiveParameters)) {
+                    $params[$key] = '********';
+                }
+            }
+        }
+
+        return $params;
+    }
+
     /**
      * @param Box_EventDispatcher $disp
      * @param string              $event