From 8c7740db0adbecf8803305a992f78f2443019fb5 Mon Sep 17 00:00:00 2001 From: SeanDuggan Date: Wed, 2 Sep 2026 22:09:38 +0100 Subject: [PATCH] fix: stop logging plaintext new password in admin password reset log.debug(newPass = + newPassword) wrote the new plaintext password to the debug log whenever an admin reset a users password. Redact it, matching the existing pattern used for passwords elsewhere in the admin servlets (log the fact it was retrieved, not the value). Fixes #571 --- .../java/servlets/admin/userManagement/ChangeUserPassword.java | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/src/main/java/servlets/admin/userManagement/ChangeUserPassword.java b/src/main/java/servlets/admin/userManagement/ChangeUserPassword.java index 18aaa6615..1563bd1f4 100644 --- a/src/main/java/servlets/admin/userManagement/ChangeUserPassword.java +++ b/src/main/java/servlets/admin/userManagement/ChangeUserPassword.java @@ -68,7 +68,7 @@ public void doPost(HttpServletRequest request, HttpServletResponse response) String player = (String) request.getParameter("player"); log.debug("player = " + player.toString()); String newPassword = (String) request.getParameter("password"); - log.debug("newPass = " + newPassword); + log.debug("newPass retrieved"); // Validation notNull = (player != null) && (newPassword != null);