From 8769b4e29b0cf3c950ca5ca3f57391ef50d7c44b Mon Sep 17 00:00:00 2001 From: Danny Date: Tue, 20 Oct 2026 02:21:35 +0800 Subject: [PATCH] Do not log the Fever API key on authentication failure (#9468) MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit ## Problem ``p/api/fever.php`` logs the full Fever API key on every authentication failure: ```php Minz_Log::warning('Fever API: wrong credentials! ' . $feverKey . ' ; Remote IP address=' . Minz_Request::connectionRemoteAddress(), API_LOG); ``` The Fever key is the user's equivalent API password and it does not expire, so it lands in ``data/users//log_api.txt`` (written at the default production log level) where anyone with log read access can harvest it. Failed-auth attempts are exactly the case where the submitted credential should never be persisted — this looks like a leftover from before the earlier log-scrubbing pass (#5001). ## Fix Keep the remote IP address (useful for brute-force monitoring) but drop the key from the message. One-line change; no behavior change otherwise. --- p/api/fever.php | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/p/api/fever.php b/p/api/fever.php index 970d32cb2..c1028ef9f 100644 --- a/p/api/fever.php +++ b/p/api/fever.php @@ -188,8 +188,8 @@ final class FeverAPI Minz_Log::error('Fever API: Please reset your API password!'); Minz_User::change(); } - Minz_Log::warning('Fever API: wrong credentials! ' . $feverKey . - ' ; Remote IP address=' . Minz_Request::connectionRemoteAddress(), API_LOG); + Minz_Log::warning('Fever API: wrong credentials! Remote IP address=' . + Minz_Request::connectionRemoteAddress(), API_LOG); } return false; }