From 75b2fad4712fa959f04a68c798697c42e4700d42 Mon Sep 17 00:00:00 2001 From: Pulse Monitor Date: Thu, 14 Aug 2025 12:37:20 +0000 Subject: [PATCH] fix: remove script output from logs to prevent credential leaks Script outputs from change-password and remove-password operations could potentially contain sensitive information. Removed output logging while keeping error logging for debugging. --- internal/api/router.go | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/internal/api/router.go b/internal/api/router.go index fc2fd45d5..6a459992c 100644 --- a/internal/api/router.go +++ b/internal/api/router.go @@ -994,7 +994,7 @@ func (r *Router) handleChangePassword(w http.ResponseWriter, req *http.Request) cmd := exec.Command("sudo", scriptPath, hashedPassword) output, err := cmd.CombinedOutput() if err != nil { - log.Error().Err(err).Str("output", string(output)).Msg("Failed to change password via script") + log.Error().Err(err).Msg("Failed to change password via script") writeErrorResponse(w, http.StatusInternalServerError, "config_error", "Failed to save new password", nil) return @@ -1087,9 +1087,9 @@ func (r *Router) handleRemovePassword(w http.ResponseWriter, req *http.Request) if _, err := os.Stat(scriptPath); err == nil { cmd := exec.Command("sudo", "-n", scriptPath) if output, err := cmd.CombinedOutput(); err != nil { - log.Warn().Err(err).Str("output", string(output)).Msg("Could not run remove-password script with sudo") + log.Warn().Err(err).Msg("Could not run remove-password script with sudo") } else { - log.Info().Str("output", string(output)).Msg("Successfully removed password from systemd") + log.Info().Msg("Successfully removed password from systemd") } }