mirror of
https://github.com/ZoneMinder/zoneminder.git
synced 2026-10-31 10:50:00 -04:00
Nic Boet
8359958068
ZmErrorHandler::redact() matched token=, auth=, pass= and password= only. A client that sends one of them as an array (token[]=x, which Cake logs as token%5B0%5D=x) still puts the value in the log, so the name may now carry [..] or %5B..%5D before the =. An empty value is no longer replaced: token= stays token=, so the log still shows a client that sent no credential. Tests: prefixes (authority, tokenize, password2, pass_hint, token_type, passwd) are not touched, arrays are redacted, empty stays empty. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> (cherry picked from commit 4789df0a0433d51e12e19cd21df5ac18e7c6305f)