Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Fix no audit if Field->never_persist = true #30

Merged
merged 3 commits into from
May 21, 2020
Merged

Conversation

abbadon1334
Copy link
Collaborator

Discovered today in dev, using atk4/login and enable audit on Model User it saves password2 ( confirmation password), disclosing every password in clear text in audit backlog.

@codecov
Copy link

codecov bot commented May 19, 2020

Codecov Report

Merging #30 into develop will increase coverage by 0.27%.
The diff coverage is 100.00%.

Impacted file tree graph

@@              Coverage Diff              @@
##             develop      #30      +/-   ##
=============================================
+ Coverage      62.00%   62.27%   +0.27%     
- Complexity       112      115       +3     
=============================================
  Files              5        5              
  Lines            279      281       +2     
=============================================
+ Hits             173      175       +2     
  Misses           106      106              
Impacted Files Coverage Δ Complexity Δ
src/Controller.php 88.81% <100.00%> (+0.14%) 74.00 <0.00> (+3.00)

Continue to review full report at Codecov.

Legend - Click here to learn more
Δ = absolute <relative> (impact), ø = not affected, ? = missing data
Powered by Codecov. Last update 702427b...5159bbc. Read the comment docs.

Copy link
Member

@DarkSide666 DarkSide666 left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Looks good, but please add the same for never_save and read_only properties.
These also can't be saved, so it's probably no use to store them in audit.

@abbadon1334 abbadon1334 requested a review from DarkSide666 May 20, 2020 16:00
@DarkSide666 DarkSide666 merged commit c8133bd into develop May 21, 2020
@DarkSide666 DarkSide666 deleted the Fix-never-persist branch May 21, 2020 10:27
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
Development

Successfully merging this pull request may close these issues.

2 participants