Bug #85773

Flaws in sys_log entry IP anonymization

Added by Oliver Hader 12 months ago. Updated 10 months ago.

Status:
Closed
Priority:
Must have
Assignee:
Category:
Backend API
Target version:
Start date:
2018-06-21
Due date:
2018-06-21
% Done:

100%

TYPO3 Version:
9
PHP Version:
7.2
Tags:
Complexity:
Is Regression:
Yes
Sprint Focus:

Description

The sys_log entry IP anonymization has several flaws which lead to a revert of the initial change in master:
  • REMOTE_ADDR is anonymized, REMOTE_HOST not (probably there are more occurrences)
  • PHP method sprintf() is invoked with too many arguments, username information is out of bounds
  • introduced in https://review.typo3.org/#/c/57313/

Related issues

Follows TYPO3 Core - Bug #85316: Anonymize IP scheduler tasks does not clean up log_data field Closed 2018-06-20

Associated revisions

Revision 8a632bda (diff)
Added by Markus Klein 12 months ago

[BUGFIX] Remove wrong parameters for log entries and remove REMOTE_HOST

Patch https://review.typo3.org/57313 introduced a number of wrong
log entry calls, which provide too much data for sprintf().
This patch removes those unneeded entries.

Moreover, this patch removes the REMOTE_HOST from log entries as those
would exact matching of the IP address, which is not desired. (GDPR)

Resolves: #85773
Related: #85316
Releases: master
Change-Id: Ic7eb288efde53f6232ee699e6786d965a67d2e7f
Reviewed-on: https://review.typo3.org/57832
Tested-by: TYPO3com <>
Reviewed-by: Wouter Wolters <>
Reviewed-by: Łukasz Uznański <>
Reviewed-by: Christian Kuhn <>
Tested-by: Christian Kuhn <>
Reviewed-by: Andreas Fernandez <>
Tested-by: Andreas Fernandez <>

History

#1 Updated by Gerrit Code Review 12 months ago

  • Status changed from New to Under Review

Patch set 2 for branch master of project Packages/TYPO3.CMS has been pushed to the review server.
It is available at https://review.typo3.org/57830

#2 Updated by Oliver Hader 12 months ago

  • Description updated (diff)

#3 Updated by Gerrit Code Review 12 months ago

Patch set 3 for branch master of project Packages/TYPO3.CMS has been pushed to the review server.
It is available at https://review.typo3.org/57830

#4 Updated by Gerrit Code Review 12 months ago

Patch set 4 for branch master of project Packages/TYPO3.CMS has been pushed to the review server.
It is available at https://review.typo3.org/57830

#5 Updated by Gerrit Code Review 12 months ago

Patch set 5 for branch master of project Packages/TYPO3.CMS has been pushed to the review server.
It is available at https://review.typo3.org/57830

#6 Updated by Oliver Hader 12 months ago

  • Status changed from Under Review to New
  • Priority changed from Should have to Must have
  • Target version set to 9.4
  • Is Regression set to Yes

Parts of the flaws have been changed in between with https://review.typo3.org/#/c/57759/
I'm leaving this as is for the time being, since I don't have the time to identify what is fixed and what not - a simple revert is however not possible anymore

#7 Updated by Markus Klein 12 months ago

  • Assignee set to Markus Klein

#8 Updated by Markus Klein 12 months ago

  • Due date set to 2018-06-21
  • Start date changed from 2018-08-07 to 2018-06-21
  • Follows Bug #85316: Anonymize IP scheduler tasks does not clean up log_data field added

#9 Updated by Gerrit Code Review 12 months ago

  • Status changed from New to Under Review

Patch set 1 for branch master of project Packages/TYPO3.CMS has been pushed to the review server.
It is available at https://review.typo3.org/57832

#10 Updated by Markus Klein 12 months ago

  • Status changed from Under Review to Resolved
  • % Done changed from 0 to 100

#11 Updated by Benni Mack 10 months ago

  • Status changed from Resolved to Closed

Also available in: Atom PDF