From 66e3da31089f51429dad402db5a49d97b4864367 Mon Sep 17 00:00:00 2001 From: Roland Becker Date: Mon, 16 Nov 2015 23:15:36 +0100 Subject: [PATCH] Add missing confidential options to function config_is_private Fixes #20277 Thanks @grangeway for pointing out master_crypto_salt vs. crypto_master_salt some while ago. --- core/config_api.php | 13 ++++++++++++- 1 file changed, 12 insertions(+), 1 deletion(-) diff --git a/core/config_api.php b/core/config_api.php index 8cace8c..20f3a2a 100644 --- a/core/config_api.php +++ b/core/config_api.php @@ -690,7 +690,12 @@ function config_is_private( $p_config_var ) { case 'database_name': case 'db_schema': case 'db_type': - case 'master_crypto_salt': + case 'db_table_prefix': + case 'db_table_plugin_prefix': + case 'db_table_suffix': + case 'use_persistent_connections': + case 'dsn': + case 'crypto_master_salt': case 'smtp_host': case 'smtp_username': case 'smtp_password': @@ -702,9 +707,11 @@ function config_is_private( $p_config_var ) { case 'class_path': case 'library_path': case 'language_path': + case 'config_path': case 'session_save_path': case 'session_handler': case 'session_validation': + case 'form_security_validation': case 'global_settings': case 'system_font_folder': case 'phpMailer_method': @@ -716,9 +723,12 @@ function config_is_private( $p_config_var ) { case 'ldap_root_dn': case 'ldap_organization': case 'ldap_uid_field': + case 'ldap_realname_field': case 'ldap_bind_dn': case 'ldap_bind_passwd': case 'use_ldap_email': + case 'use_ldap_realname': + case 'ldap_simulation_file_path': case 'ldap_protocol_version': case 'login_method': case 'cookie_path': @@ -732,6 +742,7 @@ function config_is_private( $p_config_var ) { case 'log_destination': case 'dot_tool': case 'neato_tool': + case 'debug_email': return true; # Marked obsolete in 1.3.0dev - keep here to make sure they are not disclosed by soap api. -- 2.4.9 (Apple Git-60)