Do not log passwords on failed authentication attempts (issue-316)

James Moger

2013-09-27 7535ebacc69a7b39993992c62cfc3456cdbe1d45

Do not log passwords on failed authentication attempts (issue-316)

 releases.moxie

@@ -17,6 +17,7 @@
    - Personal repository prefix (~) is now configurable (issue-265)
    - Reversed line links in blob view (issue-309)
    - Dashboard and Activity pages now obey the web.generateActivityGraph setting (issue-310)
    - Do not log passwords on failed authentication attempts (issue-316)
    - Updated default binary and Lucene ignore extensions
    additions:
    - Added branch graph image servlet based on EGit's branch graph renderer (issue-194)

 src/main/java/com/gitblit/GitBlit.java

@@ -947,8 +947,8 @@
                            user.username, httpRequest.getRemoteAddr()));
                    return user;
                } else {
                    logger.warn(MessageFormat.format("Failed login attempt for {0}, invalid credentials ({1}) from {2}", 
                            username, credentials, httpRequest.getRemoteAddr()));
                    logger.warn(MessageFormat.format("Failed login attempt for {0}, invalid credentials from {1}", 
                            username, httpRequest.getRemoteAddr()));
                }
            }
        }