Page 1 of 1
How can entered passwords be masked in log files
Posted: Wed Sep 21, 2011 2:39 pm
by frank_c
I created an installation that requires the user to enter the logon name and password to run a service. I use a standard Edit control to capture the password using * (star) as the PasswordChar. I also enabled logging using the LOGGED variable. I do not add my own messages to the log. Everything works fine, except that I see the entered password in clear text in the log. In the log, the actual command to run the service displays the password as ****, but the field that captures the password is shown in clear text in several places. Obviously, this is a concern. Is there a way to blank the password n the log file? Is there another control that I should use?
Thanks,
Frank C.
Re: How can entered passwords be masked in log files
Posted: Sat Sep 24, 2011 6:44 pm
by giaviv
Hi Frank,
Please try overriding the value inside the password variable before calling the Apply Install command.
Re: How can entered passwords be masked in log files
Posted: Thu Sep 29, 2011 4:35 pm
by frank_c
Aviv,
I tried your suggestion, but it does not completely resolve the problem. I do see fewer entries with the actual password, but they are still there. I removed all Apply Install instances, except for the last one--just after masking the password.
Any other ideas? If no workaround, can this be added a feature request or bug fix?
Thanks,
Frank C.
Re: How can entered passwords be masked in log files
Posted: Fri Sep 30, 2011 8:22 am
by giaviv
Frank,
You can also manually edit the log file after calling Apply Install - is that an option?