This project is archived and is in readonly mode.

#537 ✓wontfix
Mark Van Holstyn

allow config.action_controller.filter_parameter_logging in environment.rb

Reported by Mark Van Holstyn | July 2nd, 2008 @ 06:57 PM | in 2.x

Right now you have to configure parameter logging in the application controller. This patch lets you declare the filter parameter logging in environment.rb.

Comments and changes to this ticket

  • Daniel Morrison

    Daniel Morrison July 2nd, 2008 @ 07:25 PM

    I really like it. +1

    Personally, I'd like to see :password set by default to encourage it as a best-practice. (maybe :ssn, and :credit_card too, but those are less-common)

  • Pratik

    Pratik July 4th, 2008 @ 12:28 AM

    What are the benefits of doing it in environment.rb over application.rb ?

    Thanks.

  • Pratik

    Pratik July 14th, 2008 @ 04:44 AM

    • State changed from “new” to “wontfix”

    I don't really see any benefits. I'm closing this ticket for now. But please feel free to raise the issue in core mailing list and if we have more people in favor of this patch, we can roll it in.

    Thanks.

  • Gaius Centus Novus

    Gaius Centus Novus August 7th, 2008 @ 03:28 PM

    Sort of. +1 / -1.

    Perhaps a middle ground that retains the utility would be a Boolean:

    config.actioncontroller.filterparameter_logging = false

    rather than the actual fields, which would look more like this:

    config.actioncontroller.filterloggingofparameters :password, :ssn, ...

    The only reason to have it on is for debugging, which is only done in development (or maybe test), so the finer-grained settings aren't really useful.

  • Daniel Morrison

    Daniel Morrison August 7th, 2008 @ 03:43 PM

    Gaius,

    I definitely disagree. In production, it is more important as you are accepting real passwords, credit cards, and SSNs.

    If you're storing credit card numbers, even in log files, you're probably violating your merchant agreements.

  • Gaius Centus Novus

    Gaius Centus Novus August 7th, 2008 @ 04:00 PM

    Let me clarify: I was envisioning augmenting the current system wherein fields are declared in the controllers.

    That is:

    app/controllers/application.rb:

    
    class ApplicationController < ActionController::base
      filter_parameter_logging :password, :ssn, ...
      ...
    end
    

    config/environments/development.rb:

    
    config.action_controller.filter_parameter_logging = false
    # or even
    config.action_controller.filter_parameter_logging = []
    

    By default, the filtering would be on, leaving the Controllers to dictate the behavior.

  • Gaius Centus Novus

    Gaius Centus Novus August 7th, 2008 @ 04:02 PM

    Now I see your confusion, Daniel.

    By "The only reason to have it on is for debugging," I clearly meant "The only reason to have it off is for debugging." [laughs at self being ridiculously bad at proof-reading]

Create your profile

Help contribute to this project by taking a few moments to create your personal profile. Create your profile »

<h2 style="font-size: 14px">Tickets have moved to Github</h2>

The new ticket tracker is available at <a href="https://github.com/rails/rails/issues">https://github.com/rails/rails/issues</a>

Attachments

Tags

Pages