fix(xo-server/api): private data in api call (#8019)

vatesfr · Sep 27, 2024 · 939ab29 · 939ab29
1 parent cdfe0b0
commit 939ab29
Show file tree

Hide file tree

Showing 2 changed files with 3 additions and 1 deletion.
diff --git a/CHANGELOG.unreleased.md b/CHANGELOG.unreleased.md
@@ -27,6 +27,7 @@
 > Users must be able to say: “I had this issue, happy to know it's fixed”
 
 - [REST API] Fix broken _Rolling Pool Update_ pool action [Forum#82867](https://xcp-ng.org/forum/post/82867)
+- [Logs] Fix private data in API call: password now obfuscated (PR [#8019](https://github.com/vatesfr/xen-orchestra/pull/8019))
 
 ### Packages to release
 

diff --git a/packages/xo-server/src/xo-mixins/api.mjs b/packages/xo-server/src/xo-mixins/api.mjs
@@ -398,10 +398,11 @@ export default class Api {
 
       const resolvedParams = await resolveParams.call(app, method, params)
 
+      // data.params contains obfuscated params
       let result = await (name in NO_LOG_METHODS
         ? method.call(app, resolvedParams)
         : app.tasks
-            .create({ name: 'API call: ' + name, method: name, params, type: 'api.call' }, { clearLogOnSuccess: true })
+            .create({ name: 'API call: ' + name, method: name, params: data.params, type: 'api.call' }, { clearLogOnSuccess: true })
             .run(() => method.call(app, resolvedParams)))
 
       // If nothing was returned, consider this operation a success