Version: 2.11.0
Bug Description
Tracy documentation has a section about using Nette Framework configuration.
It says that setting tracy.keysToHide will hide (sanitize) the values of the keys specified when a variable is dumped using dump(). To me it seems that's not the case, and that tracy.keysToHide is only used for the (red) bluescreen, and not for dump() or bdump():
|
'keysToHide' => 'array_push(Tracy\Debugger::getBlueScreen()->keysToHide, ... ?)', |
Steps To Reproduce
Use the following config:
tracy:
keysToHide: [password, pass, foobar]
Then ad the following somewhere in the project:
dump(['password' => 'foo']);
bdump(['password' => 'foo']);
The array dumped to both the screen and the Tracy bar will have the password not hidden.
Expected Behavior
I'd expect the password to be hidden, especially when the documentation says so.
Possible Solution
I'm not sure, but the following works for me, as a proof of concept. Instead of setting keysToHide on the bluescreen object only, I set it on both.
Replace this:
|
$tbl = [ |
|
'keysToHide' => 'array_push(Tracy\Debugger::getBlueScreen()->keysToHide, ... ?)', |
|
'fromEmail' => 'if ($logger instanceof Tracy\Logger) $logger->fromEmail = ?', |
with the following code:
if ($key === 'keysToHide') {
$initialize->addBody($builder->formatPhp('Tracy\Debugger::$keysToHide = ?;', Nette\DI\Helpers::filterArguments([$value])));
$initialize->addBody($builder->formatPhp('array_push(Tracy\Debugger::getBlueScreen()->keysToHide, ... ?);', Nette\DI\Helpers::filterArguments([$value])));
continue;
}
$tbl = [
'fromEmail' => 'if ($logger instanceof Tracy\Logger) $logger->fromEmail = ?',
There's probably a better way but if there isn't, I'll happily prepare a pull request (done #609)
Version: 2.11.0
Bug Description
Tracy documentation has a section about using Nette Framework configuration.
It says that setting
tracy.keysToHidewill hide (sanitize) the values of the keys specified when a variable is dumped usingdump(). To me it seems that's not the case, and thattracy.keysToHideis only used for the (red) bluescreen, and not fordump()orbdump():tracy/src/Bridges/Nette/TracyExtension.php
Line 108 in 7543389
Steps To Reproduce
Use the following config:
Then ad the following somewhere in the project:
The array dumped to both the screen and the Tracy bar will have the password not hidden.
Expected Behavior
I'd expect the password to be hidden, especially when the documentation says so.
Possible Solution
I'm not sure, but the following works for me, as a proof of concept. Instead of setting
keysToHideon the bluescreen object only, I set it on both.Replace this:
tracy/src/Bridges/Nette/TracyExtension.php
Lines 107 to 109 in 7543389
with the following code:
There's probably a better way but if there isn't, I'll happily prepare a pull request (done #609)