keep the alarm password and the database credentials out of the reload dump

global_dump(), run after every "reload" of the daemon, printed the globals
it checks to stderr, that is to the daemon log, G_alarm_passwd and
G_dbauth among them: the password of admin.php and the connection string
of the database, password included, in clear in a log file.

The dump is there to show that the globals survived the reload, and for
those two it is enough to know whether they are set: they are now printed
as "(set)" or "(empty)". The other globals are printed as before.

Checked by calling global_dump() with both secrets set and empty: the log
says set or empty and contains neither value.

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>

diff --git a/web/Obj/sac-a-push.phh b/web/Obj/sac-a-push.phh
index 09d5fc1be693c91a9abd3d0c5542e7b427f5d6ee..24cd5dfb5bf6aab32bba10ad781ca62b8f97f301 100644 (file)
--- a/web/Obj/sac-a-push.phh
+++ b/web/Obj/sac-a-push.phh
@@ -58,11 +58,13 @@ function global_dump()
     GLOBAL $G_with_splash, $G_sidebanner, $G_sidebanner_idx;
     GLOBAL $G_with_topbanner, $G_selfreg_tout, $G_selfreg_mask;
 
-    fprintf(STDERR, "G_alarm_passwd = [%s]\n", print_r($G_alarm_passwd, TRUE));
+    /* the dump only has to show that the globals survived a reload: the two
+       secrets are reported as set or empty, never written to the log */
+    fprintf(STDERR, "G_alarm_passwd = [%s]\n", ($G_alarm_passwd == "" ? "(empty)" : "(set)"));
     fprintf(STDERR, "G_ban_list = [%s]\n", print_r($G_ban_list, TRUE));
     fprintf(STDERR, "G_black_list = [%s]\n", print_r($G_black_list, TRUE));
     fprintf(STDERR, "G_btrace_pref_sub = [%s]\n", print_r($G_btrace_pref_sub, TRUE));
-    fprintf(STDERR, "G_dbauth = [%s]\n", print_r($G_dbauth, TRUE));
+    fprintf(STDERR, "G_dbauth = [%s]\n", ($G_dbauth == "" ? "(empty)" : "(set)"));
     fprintf(STDERR, "G_dbpfx = [%s]\n", print_r($G_dbpfx, TRUE));
     fprintf(STDERR, "G_donors_all = [%s]\n", print_r($G_donors_all, TRUE));
     fprintf(STDERR, "G_donors_cur = [%s]\n", print_r($G_donors_cur, TRUE));