utils-logs.inc.php: 260917 vs 260805 · s2Member – Excellent for All Kinds of Memberships, Content Restriction Paywalls & Member Access Subscriptions

← All changes | src/includes/classes/utils-logs.inc.php +5 -4 260805 → 260917 View file →

		@@ -127,25 +127,26 @@
127	127
128	128	$log_entry = preg_replace('/(\'.pass_?(?:word)?(?:[0-9]+)?\'\s\=\>\s*\')([^\']+)(\')/', '$1'.'xxxxxxxx/pass'.'$3', $log_entry);
129	129	$log_entry = preg_replace('/(\[\s[^\]\r\n]pass_?(?:word)?(?:[0-9]+)?[^\]\r\n]\]\s\=\>\s)([^\r\n])/i', '$1'.'xxxxxxxx/pass', $log_entry);
130	130	$log_entry = preg_replace('/(\".pass_?(?:word)?(?:[0-9]+)?\"\s\:\s*\")([^\"]+)(\")/i', '$1'.'xxxxxxxx/pass'.'$3', $log_entry);
131		- $log_entry = preg_replace('/([&?][^&]*pass_?(?:word)?(?:[0-9]+)?\=)([^&]+)/', '$1'.'xxxxxxxx/pass', $log_entry);
	131	+ //260830.1632 Query-string redaction must stop at CR/LF as well as `&`; debug logs are multiline, and scanning across entries can make PCRE fail and return NULL.
	132	+ $log_entry = preg_replace('/([&?][^&\r\n]*pass_?(?:word)?(?:[0-9]+)?\=)([^&\r\n]+)/', '$1'.'xxxxxxxx/pass', $log_entry);
132	133
133	134	$log_entry = preg_replace('/(\'api_?(?:key\|secret)\'\s\=\>\s\')([^\']+)(\')/', '$1'.'xxxxxxxx/api/key/sec'.'$3', $log_entry);
134	135	$log_entry = preg_replace('/(\[\s[^\]\r\n]api_?(?:key\|secret)[^\]\r\n]\]\s\=\>\s)([^\r\n])/i', '$1'.'xxxxxxxx/api/key/sec', $log_entry);
135	136	$log_entry = preg_replace('/(\"[^\"]api_?(?:key\|secret)[^\"]\"\s\:\s\")([^\"]+)(\")/i', '$1'.'xxxxxxxx/api/key/sec'.'$3', $log_entry);
136		- $log_entry = preg_replace('/([&?][^&]*api_?(?:key\|secret)\=)([^&]+)/i', '$1'.'xxxxxxxx/api/key/sec', $log_entry);
	137	+ $log_entry = preg_replace('/([&?][^&\r\n]*api_?(?:key\|secret)\=)([^&\r\n]+)/i', '$1'.'xxxxxxxx/api/key/sec', $log_entry);
137	138
138	139	$log_entry = preg_replace('/(\'(?:PWD\|SIGNATURE)\'\s\=\>\s\')([^\']+)(\')/', '$1'.'xxxxxxxx/PWD/SIG'.'$3', $log_entry);
139	140	$log_entry = preg_replace('/(\[\s[^\]\r\n](?:PWD\|SIGNATURE)[^\]\r\n]\]\s\=\>\s)([^\r\n])/', '$1'.'xxxxxxxx/PWD/SIG', $log_entry);
140	141	$log_entry = preg_replace('/(\"(?:PWD\|SIGNATURE)\"\s\:\s\")([^\"]+)(\")/', '$1'.'xxxxxxxx/PWD/SIG'.'$3', $log_entry);
141		- $log_entry = preg_replace('/([&?][^&]*(?:PWD\|SIGNATURE)\=)([^&]+)/', '$1'.'xxxxxxxx/PWD/SIG', $log_entry);
	142	+ $log_entry = preg_replace('/([&?][^&\r\n]*(?:PWD\|SIGNATURE)\=)([^&\r\n]+)/', '$1'.'xxxxxxxx/PWD/SIG', $log_entry);
142	143	$log_entry = preg_replace('/((?:^\|[&?])[^&\r\n](?:PWD\|SIGNATURE)(?:\[[^\]&=]\]\|%5B[^&=]*%5D)?\=)([^&\r\n]+)/im', '$1'.'xxxxxxxx/PWD/SIG', $log_entry);
143	144
144	145	$log_entry = preg_replace('/(\'(?:x_login\|x_tran_key)\'\s\=\>\s\')([^\']+)(\')/', '$1'.'xxxxxxxx/key/tran'.'$3', $log_entry);
145	146	$log_entry = preg_replace('/(\[\s[^\]\r\n](?:x_login\|x_tran_key)[^\]\r\n]\]\s\=\>\s)([^\r\n])/i', '$1'.'xxxxxxxx/key/tran', $log_entry);
146	147	$log_entry = preg_replace('/(\"(?:x_login\|x_tran_key)\"\s\:\s\")([^\"]+)(\")/i', '$1'.'xxxxxxxx/key/tran'.'$3', $log_entry);
147		- $log_entry = preg_replace('/([&?][^&]*(?:x_login\|x_tran_key)\=)([^&]+)/i', '$1'.'xxxxxxxx/key/tran', $log_entry);
	148	+ $log_entry = preg_replace('/([&?][^&\r\n]*(?:x_login\|x_tran_key)\=)([^&\r\n]+)/i', '$1'.'xxxxxxxx/key/tran', $log_entry);
148	149
149	150	//260617 Conceal card verification values in gateway and HTTP API logs.
150	151	$log_entry = preg_replace('/(\'(?:CVV2?\|CVC2?\|CSC\|CARD_?CODE\|X_CARD_CODE\|x_card_code\|card_?code\|card_?verification)\'\s\=\>\s\')([^\']+)(\')/i', '$1'.'xxxxxxxx/cvv'.'$3', $log_entry);
151	152	$log_entry = preg_replace('/(\[\s[^\r\n](?:CVV2?\|CVC2?\|CSC\|CARD_?CODE\|X_CARD_CODE\|x_card_code\|card_?code\|card_?verification)[^\r\n]\]\s\=\>\s)([^\r\n])/i', '$1'.'xxxxxxxx/cvv', $log_entry);