From: Matteo Nastasi <nastasi@alternativeoutput.it>
Date: Wed, 7 Oct 2026 07:23:24 +0000 (+0200)
Subject: keep the alarm password and the database credentials out of the reload dump
X-Git-Url: https://mop.ddnsfree.com/gitweb/?a=commitdiff_plain;h=62d1a8fdff61724ed0e9ab37eac74da4ade70f1d;p=brisk.git

keep the alarm password and the database credentials out of the reload dump

global_dump(), run after every "reload" of the daemon, printed the globals
it checks to stderr, that is to the daemon log, G_alarm_passwd and
G_dbauth among them: the password of admin.php and the connection string
of the database, password included, in clear in a log file.

The dump is there to show that the globals survived the reload, and for
those two it is enough to know whether they are set: they are now printed
as "(set)" or "(empty)". The other globals are printed as before.

Checked by calling global_dump() with both secrets set and empty: the log
says set or empty and contains neither value.

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
---

diff --git a/web/Obj/sac-a-push.phh b/web/Obj/sac-a-push.phh
index 09d5fc1..24cd5df 100644
--- a/web/Obj/sac-a-push.phh
+++ b/web/Obj/sac-a-push.phh
@@ -58,11 +58,13 @@ function global_dump()
     GLOBAL $G_with_splash, $G_sidebanner, $G_sidebanner_idx;
     GLOBAL $G_with_topbanner, $G_selfreg_tout, $G_selfreg_mask;
 
-    fprintf(STDERR, "G_alarm_passwd = [%s]\n", print_r($G_alarm_passwd, TRUE));
+    /* the dump only has to show that the globals survived a reload: the two
+       secrets are reported as set or empty, never written to the log */
+    fprintf(STDERR, "G_alarm_passwd = [%s]\n", ($G_alarm_passwd == "" ? "(empty)" : "(set)"));
     fprintf(STDERR, "G_ban_list = [%s]\n", print_r($G_ban_list, TRUE));
     fprintf(STDERR, "G_black_list = [%s]\n", print_r($G_black_list, TRUE));
     fprintf(STDERR, "G_btrace_pref_sub = [%s]\n", print_r($G_btrace_pref_sub, TRUE));
-    fprintf(STDERR, "G_dbauth = [%s]\n", print_r($G_dbauth, TRUE));
+    fprintf(STDERR, "G_dbauth = [%s]\n", ($G_dbauth == "" ? "(empty)" : "(set)"));
     fprintf(STDERR, "G_dbpfx = [%s]\n", print_r($G_dbpfx, TRUE));
     fprintf(STDERR, "G_donors_all = [%s]\n", print_r($G_donors_all, TRUE));
     fprintf(STDERR, "G_donors_cur = [%s]\n", print_r($G_donors_cur, TRUE));