User/Password in Error logs

[daleguerra]

I noticed that a lot or users of my forum are trying to enter before registering.

They introduce their usual user & password and the error is saved.

The question is: Why the password is not encrypted (or with asterisks) in error logs?

I could know a lot of valid user/password from my forum, i don't worry about that becouse i know i never going to use it... but... what happens in other forums i'm (and others, of course) registered?

Thanks a lot.
Regards...

[Jeff Lewis]

It's showing so that you can see when people are running hack attempts or attempting to access admin accounts.

[daleguerra]

But I consider that we don't need the password to know someone is attempting it. The number of attempts shows us the same, isn't it?

Otherwise, it's usefull to know if someone is trying to access the admin account(s).

And why not process this in a different way?... admins: plain text, users: encrypted (or asterisked) text.

Regards...

[Jeff Lewis]

Feel free to modify it, thats why it's open source

[daleguerra]

  Thanx Jeff

It's gonna be a hard work because i don´t know php code very much.

Where in php's i must do this change?
Thanks a lot.

[Jeff Lewis]

if you just want to remove that part it's pretty easy.  The code to add it to the error log is in LogInOut.php

If it fails password, it calls fatal error and passes the user and pass on.  Can remove the password variable if you want.

As for processing it in a different way, not sure what you mean...

[daleguerra]

OK, Jeff... i'll do it. Thanx.

As for processing it in a different way, not sure what you mean...

2 ways:

1) Admin accounts: To do the same as currently.
2) Other accounts: Convert password into asterisk before saving log.

It could be possible?

[Jeff Lewis]

The thing about the log...only admins can see it anyway