Repository navigation
Conversation
metadata.json, which is uploaded with every backup and kept as a copy in EE_BACKUP_DIR, held the site's database and admin passwords. Restore never reads them (it uses the current site's credentials), so they are now removed before the file is written, and a migration removes them from the local metadata copies of earlier backups. Backups made before this still restore. The EasyDash verification token is no longer written to debug output and is masked in the logged callback payloads.
The success callback payload is logged at debug level; its verification token is now replaced with ****** in the logged copy, so it doesn't depend on core masking the value. The metadata migration also checks the JSON encoding before replacing a file.
Contributor
There was a problem hiding this comment.
🟡 Changes recommended
Site-auth passwords remain exposed, and partial migration writes could corrupt metadata.
3 open findings
What changed in this PR
Removes sensitive credentials from backup metadata and masks EasyDash verification tokens in logs.
Changes:
- Redacts password fields from newly generated metadata.
- Migrates existing local metadata copies.
- Masks EasyDash callback tokens in debug output.
| File | Description |
|---|---|
src/helper/Site_Backup_Restore.php |
Redacts metadata credentials and masks callback tokens. |
migrations/db/20261001110000_site-command_strip_backup_metadata_credentials.php |
Removes credentials from existing local metadata. |
🧠 Review effort: Balanced
💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.
…adata Check the temporary file's byte count before it replaces the metadata, so a short write never truncates it.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Backup metadata (
metadata.json, uploaded with every backup and copied to the local backup dir) no longer holds the database and admin passwords. Restore always used the current site's credentials, so all backups still restore, on old and new versions alike. A migration removes the passwords from the local metadata copies (copies already on the remote are unchanged; they rotate out withno-of-backups). The EasyDash token is masked in the logged callback payload.