Ruby on Rails

Comments and changes to this ticket

• 

  Daniel Morrison July 2nd, 2008 @ 07:25 PM

  I really like it. +1

  Personally, I'd like to see :password set by default to encourage it as a best-practice. (maybe :ssn, and :credit_card too, but those are less-common)

• 

  Pratik July 4th, 2008 @ 12:28 AM

  What are the benefits of doing it in environment.rb over application.rb ?

  Thanks.

• 

  Pratik July 14th, 2008 @ 04:44 AM

  • → State changed from “new” to “wontfix”

  I don't really see any benefits. I'm closing this ticket for now. But please feel free to raise the issue in core mailing list and if we have more people in favor of this patch, we can roll it in.

  Thanks.

• 

  Gaius Centus Novus August 7th, 2008 @ 03:28 PM

  Sort of. +1 / -1.

  Perhaps a middle ground that retains the utility would be a Boolean:

  config.actioncontroller.filterparameter_logging = false

  rather than the actual fields, which would look more like this:

  config.actioncontroller.filterloggingofparameters :password, :ssn, ...

  The only reason to have it on is for debugging, which is only done in development (or maybe test), so the finer-grained settings aren't really useful.

• 

  Daniel Morrison August 7th, 2008 @ 03:43 PM

  Gaius,

  I definitely disagree. In production, it is more important as you are accepting real passwords, credit cards, and SSNs.

  If you're storing credit card numbers, even in log files, you're probably violating your merchant agreements.

• 

  Gaius Centus Novus August 7th, 2008 @ 04:00 PM

  Let me clarify: I was envisioning augmenting the current system wherein fields are declared in the controllers.

  That is:

  app/controllers/application.rb:

  
  class ApplicationController < ActionController::base
    filter_parameter_logging :password, :ssn, ...
    ...
  end
  

  config/environments/development.rb:

  
  config.action_controller.filter_parameter_logging = false
  # or even
  config.action_controller.filter_parameter_logging = []
  

  By default, the filtering would be on, leaving the Controllers to dictate the behavior.

• 

  Gaius Centus Novus August 7th, 2008 @ 04:02 PM

  Now I see your confusion, Daniel.

  By "The only reason to have it on is for debugging," I clearly meant "The only reason to have it off is for debugging." [laughs at self being ridiculously bad at proof-reading]