Repository navigation
fix(site): keep database passwords out of the log - #514
Merged
mrrobot47 merged 2 commits intoOct 12, 2026
Merged
Conversation
When a statement fails, the mysql client echoes it to STDERR, and EE logs the STDERR of every command, so a failed CREATE USER wrote the new user's password to ee.log. Global-db SQL now runs with --loose-skip-print-query-on-error (older clients without the option only print a warning), and the password is passed as a value to obfuscate, which masks it in the logged output. Loading a site also registers its database and admin passwords with EE::obfuscate() when core provides it, and 'ee site info --format=json' prints the site row without writing it to the log.
The logs directory is now created readable by root only, so the log output step reads it with sudo.
Contributor
There was a problem hiding this comment.
🟡 Changes recommended
Credential-bearing subprocess output can still reach logs because the current core does not redact captured stdout or stderr.
2 open findings
What changed in this PR
Prevents site credentials and database passwords from being written to EasyEngine logs.
Changes:
- Outputs JSON site information without directly logging it.
- Adds credential obfuscation and suppresses failed SQL query echoing.
- Reads protected CI logs using
sudo.
| File | Description |
|---|---|
src/site-type/HTML.php |
Avoids directly logging credential-bearing JSON. |
src/helper/site-utils.php |
Registers secrets and hardens global database logging. |
.github/workflows/test_and_build.yml |
Reads root-protected logs in CI. |
🧠 Review effort: Balanced
💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Global-db SQL runs with
--loose-skip-print-query-on-error, so a failing statement is not echoed into the logged output, and the new user's password is passed to$obfuscate. Loading a site registers its credentials for masking (when core provides it), andsite info --format=jsonno longer writes the site row to the log. CI reads the logs with sudo.