scriptoriumadmin/open-webui
1
0
Fork 0
mirror of https://github.com/open-webui/open-webui.git synced 2026-10-05 02:41:34 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions 2

fix: audit log records new passwords in plain text (#31622)

Browse source 
With request auditing turned on, the audit log only masked fields named exactly "password". The new password from a password change, and passwords entered in admin settings such as YaCy or Jupyter, were written to the log as-is. Any field whose name ends in "password", in any letter case, is now replaced with asterisks.
This commit is contained in:
Classic298 2026-09-30 17:09:03 +02:00 • committed by GitHub
parent b4ebd0d62f
commit d3dde3609d
No known key found for this signature in database
GPG key ID: B5690EEEBB952194
1 changed files with 4 additions and 3 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

7
backend/open_webui/utils/audit.py
View file

@ -282,11 +282,12 @@ class AuditLoggingMiddleware:
response_body = context.response_body.decode('utf-8', errors='replace')
# Redact sensitive information
if 'password' in request_body:
if 'password' in request_body.lower():
request_body = re.sub(
r'"password":\s*"(.*?)"',
'"password": "********"',
r'"(\w*password)":\s*".*?"',
r'"\1": "********"',
request_body,
flags=re.IGNORECASE,
)
entry = AuditLogEntry(