Login passwords stored in plain text in runtime logs

[Thomas789s]

I noticed that both for the frontend and backend of OSC4, the email addresses and passwords of all login events are both stored in plain text in the logs lib/frontend/runtime/logs/app.log and /lib/backend/runtime/logs/app.log.

I feel this is not acceptable and a big security risk.

[pan-oscom]

When logging, get/post variables are saved, so email and password could get into the log when an error occurred. This is fixed in today's commit

[Neustradamus]

Dear @osCommerce team, @JanZ, @haraldpdl, @markkevans, @gburton, @acidvertigo, @Gergely, @tgely, @osc2nuke, @scottcwilson, @nickw108, @foxp2, @gadlol, @vakondweb, @anthonyjhicks, @mommaroodles, @ynechitajlo, @pan-oscom, @vladmalyshev: Have you seen this security ticket?

[gburton]

@Neustradamus you have tagged many people who are no longer involved at osCommerce.