| @@ -170,8 +170,15 @@ | ||
| 170 | 170 | ); |
| 171 | 171 | |
| 172 | 172 | $params = apply_filters( 'mainwp_plugin_information_sslverify', $default, $args ); |
| 173 | 173 | |
| 174 | + // MWP-1546 (Codex follow-up): redact api_key everywhere it appears | |
| 175 | + // before handing data to the logger. The previous code only masked | |
| 176 | + // the top-level api_key; the per-extension api_keys nested inside | |
| 177 | + // the bulk-check `extensions` payload (and the api_key= param baked | |
| 178 | + // into target_url itself) were both written to the log in plaintext. | |
| 179 | + // For installs running the file logger that turned every cron | |
| 180 | + // update-check tick into a persistence path for credentials. | |
| 174 | 181 | $log_args = $args; |
| 175 | 182 | if ( isset( $log_args['api_key'] ) ) { |
| 176 | 183 | $log_args['api_key'] = '***'; |
| 177 | 184 | } |
| @@ -176,14 +183,26 @@ | ||
| 176 | 183 | $log_args['api_key'] = '***'; |
| 177 | 184 | } |
| 178 | 185 | |
| 179 | 186 | if ( ! empty( $log_args['extensions'] ) ) { |
| 180 | - $log_exts = json_decode( base64_decode( $log_args['extensions'] ), true ); // phpcs:ignore WordPress.PHP.DiscouragedPHPFunctions -- NOSONAR base64_decode used for http encoding compatible. | |
| 181 | - $log_args['_decoded_extensions'] = is_array( $log_exts ) ? $log_exts : array(); | |
| 187 | + $log_exts = json_decode( base64_decode( $log_args['extensions'] ), true ); // phpcs:ignore WordPress.PHP.DiscouragedPHPFunctions -- NOSONAR base64_decode used for http encoding compatible. | |
| 188 | + if ( is_array( $log_exts ) ) { | |
| 189 | + foreach ( $log_exts as $log_ext_key => $log_ext ) { | |
| 190 | + if ( is_array( $log_ext ) && isset( $log_ext['api_key'] ) ) { | |
| 191 | + $log_exts[ $log_ext_key ]['api_key'] = '***'; | |
| 192 | + } | |
| 193 | + } | |
| 194 | + } else { | |
| 195 | + $log_exts = array(); | |
| 196 | + } | |
| 197 | + $log_args['_decoded_extensions'] = $log_exts; | |
| 182 | 198 | unset( $log_args['extensions'] ); |
| 183 | 199 | } |
| 184 | 200 | |
| 185 | - MainWP_Logger::instance()->log_events( 'extension-updates-check', sprintf( '[target_url=%s] :: [params=%s] :: [bulk_check=%s]', $target_url, print_r( $log_args, true ), $bulk_check ? 'true' : 'false' ) ); // phpcs:ignore WordPress.PHP.DevelopmentFunctions -- print_r used for debugging. | |
| 201 | + // Strip api_key from the URL query string before logging. | |
| 202 | + $log_target_url = preg_replace( '/(\?|&)api_key=[^&]*/', '$1api_key=***', $target_url ); | |
| 203 | + | |
| 204 | + MainWP_Logger::instance()->log_events( 'extension-updates-check', sprintf( '[target_url=%s] :: [params=%s] :: [bulk_check=%s]', $log_target_url, print_r( $log_args, true ), $bulk_check ? 'true' : 'false' ) ); // phpcs:ignore WordPress.PHP.DevelopmentFunctions -- print_r used for debugging. | |
| 186 | 205 | |
| 187 | 206 | $request = wp_remote_get( |
| 188 | 207 | $target_url, |
| 189 | 208 | $params |
