Severity: MEDIUM
Location: lib/Controller/SettingsController.php lines 285, 364, 448, 712, 1394, 1474, 1915, 2002, 2336
Description:
Multiple error-path log statements include the full request parameter set:
'requestData' => $this->request->getParams()
'rawInput' => $rawInput
Any 5xx exception during a config-update request (e.g. SMTP settings, API key updates) causes the complete request body — including smtpPassword, sendgridApiKey, mailgunApiKey, postmarkApiKey, sesSecretKey, mailjetSecretKey — to be written to the NC application log. Anyone with access to the log (sysadmin, log aggregation service) can harvest these credentials.
Suggested fix:
Before logging, redact known secret keys from the parameter array. At minimum, log parameter keys only (not values), or explicitly exclude credential fields.
Source: deep team-reviewer pass 2026-05-27
Severity: MEDIUM
Location:
lib/Controller/SettingsController.phplines 285, 364, 448, 712, 1394, 1474, 1915, 2002, 2336Description:
Multiple error-path log statements include the full request parameter set:
Any 5xx exception during a config-update request (e.g. SMTP settings, API key updates) causes the complete request body — including
smtpPassword,sendgridApiKey,mailgunApiKey,postmarkApiKey,sesSecretKey,mailjetSecretKey— to be written to the NC application log. Anyone with access to the log (sysadmin, log aggregation service) can harvest these credentials.Suggested fix:
Before logging, redact known secret keys from the parameter array. At minimum, log parameter keys only (not values), or explicitly exclude credential fields.
Source: deep team-reviewer pass 2026-05-27