Bug#599712: [rt.cpan.org #62040] [PATCH] leaks passwords to the logs

[Ivan Kohler via RT]

<URL: https://rt.cpan.org/Ticket/Display.html?id=62040 >

Here is a simple fix for this issue.  I opted to keep the messages and
just omit the password.



Index: AuthenHook.xs
===================================================================
--- AuthenHook.xs	(revision 63560)
+++ AuthenHook.xs	(working copy)
@@ -180,8 +180,8 @@
 
     case OK:
       ap_log_rerror(APLOG_MARK, APLOG_INFO, 0, r,
-                    "Apache::AuthenHook - user '%s', password '%s' verified",
-                    user, password);
+                    "Apache::AuthenHook - user '%s' verified",
+                    user);
 
       status = AUTH_GRANTED;
       break;
@@ -196,8 +196,8 @@
 
     default:
       ap_log_rerror(APLOG_MARK, APLOG_INFO, 0, r,
-                    "Apache::AuthenHook - user '%s', password '%s' denied",
-                    user, password);
+                    "Apache::AuthenHook - user '%s' denied",
+                    user);
 
       status = AUTH_DENIED;
   };