ZmErrorHandler::redact() matched token=, auth=, pass= and password=
only. A client that sends one of them as an array (token[]=x, which
Cake logs as token%5B0%5D=x) still puts the value in the log, so the
name may now carry [..] or %5B..%5D before the =.
An empty value is no longer replaced: token= stays token=, so the log
still shows a client that sent no credential.
Tests: prefixes (authority, tokenize, password2, pass_hint, token_type,
passwd) are not touched, arrays are redacted, empty stays empty.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
(cherry picked from commit 4789df0a04)
Cake logs every uncaught exception, 4xx included, with "Request URL:"
and the full query string. API clients may authenticate with ?token=,
?auth= or ?user=&pass=, so a 401, 404 or 500 wrote a working access
token, auth hash or password to cake_error.log and error.log in
ZM_LOGDIR, both world-readable.
ZmErrorHandler extends Cake's ErrorHandler and replaces the values of
token, auth, pass and password with [redacted] in the logged message.
core.php uses it for both errors and exceptions.
Credentials in the query string still reach web server and proxy
access logs; that is outside the API code.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
(cherry picked from commit b80568847d)
Nic Boet