Skip to content

Commit 09e477e

Browse files
kurowskikurowski
authored
Merge pull request #2 from UCEAP/config
configure sensitive fields
2 parents 7d33262 + fbd9010 commit 09e477e

7 files changed

Lines changed: 134 additions & 15 deletions

File tree

‎README.md‎

Lines changed: 18 additions & 9 deletions
Original file line numberDiff line numberDiff line change
@@ -135,19 +135,28 @@ When integrated with Monolog and CloudWatch, logs are automatically sent to Clou
135135
136136
### Sensitive Field Masking
137137
138-
By default, the following sensitive fields have their values masked in logs:
138+
The module provides configurable masking of sensitive field values in entity change logs. When sensitive fields are modified, they appear in logs with masked values (e.g., `***MASKED***`) instead of actual values, providing an audit trail while protecting sensitive data.
139+
140+
#### Default Sensitive Fields
141+
142+
By default, the following field has its value masked:
139143
- `pass` - User passwords
140-
- `uuid` - Entity UUIDs
141-
- `revision_timestamp` - Revision timestamps
142-
- `revision_uid` - Revision authors
143-
- `revision_log` - Revision log messages
144-
- `changed` - Changed timestamps
145144
146-
When these fields are modified, they appear in the logs with masked values (e.g., `***MASKED***`) instead of actual values, providing an audit trail while protecting sensitive data.
145+
#### Configuring Sensitive Fields
146+
147+
You can customize which fields are masked through the administrative interface:
148+
149+
1. Navigate to **Configuration** > **Development** > **Logging and errors** (`/admin/config/development/logging`)
150+
2. Click on the **UCEAP Logging** tab
151+
3. Enter field machine names (one per line) in the "Sensitive Fields" textarea
152+
4. Click "Save configuration"
147153
148-
Additionally, computed and internal fields are automatically excluded from logging as they are derived values.
154+
#### Automatically Excluded Fields
149155
150-
To customize which fields are masked, modify the `$sensitive_fields` array in `_uceap_logging_get_entity_field_changes()`.
156+
In addition to user-configured sensitive fields, the following field types are automatically excluded from change tracking entirely:
157+
- Computed fields (derived values)
158+
- Internal fields (system-managed)
159+
- Specific metadata fields: `changed`, `revision_timestamp`, `revision_uid`, `revision_log`
151160
152161
### Logger Channels
153162

‎config/install/uceap_logging.settings.yml‎

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,2 @@
1+
sensitive_fields:
2+
- pass

‎config/schema/uceap_logging.schema.yml‎

Lines changed: 10 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,10 @@
1+
uceap_logging.settings:
2+
type: config_object
3+
label: 'UCEAP Logging Settings'
4+
mapping:
5+
sensitive_fields:
6+
type: sequence
7+
label: 'Sensitive fields'
8+
sequence:
9+
type: string
10+
label: 'Field name'

‎src/Form/LoggingSettingsForm.php‎

Lines changed: 82 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,82 @@
1+
<?php
2+
3+
namespace Drupal\uceap_logging\Form;
4+
5+
use Drupal\Core\Form\ConfigFormBase;
6+
use Drupal\Core\Form\FormStateInterface;
7+
8+
/**
9+
* Configure UCEAP Logging settings.
10+
*/
11+
class LoggingSettingsForm extends ConfigFormBase {
12+
13+
/**
14+
* {@inheritdoc}
15+
*/
16+
public function getFormId() {
17+
return 'uceap_logging_settings';
18+
}
19+
20+
/**
21+
* {@inheritdoc}
22+
*/
23+
protected function getEditableConfigNames() {
24+
return ['uceap_logging.settings'];
25+
}
26+
27+
/**
28+
* {@inheritdoc}
29+
*/
30+
public function buildForm(array $form, FormStateInterface $form_state) {
31+
$config = $this->config('uceap_logging.settings');
32+
33+
$form['sensitive_fields'] = [
34+
'#type' => 'textarea',
35+
'#title' => $this->t('Sensitive Fields'),
36+
'#description' => $this->t('Enter field machine names (one per line) that should have their values masked in entity change logs. When these fields are modified, they will appear in logs with masked values (e.g., ***MASKED***) instead of actual values.'),
37+
'#default_value' => implode("\n", $config->get('sensitive_fields') ?? []),
38+
'#rows' => 10,
39+
];
40+
41+
$form['help'] = [
42+
'#type' => 'details',
43+
'#title' => $this->t('Examples'),
44+
'#open' => FALSE,
45+
];
46+
47+
$form['help']['examples'] = [
48+
'#markup' => $this->t('<p>Common sensitive fields include:</p>
49+
<ul>
50+
<li><code>field_ssn</code> - Social Security Numbers</li>
51+
<li><code>pass</code> - User passwords</li>
52+
<li><code>field_bank_account</code> - Banking information</li>
53+
<li><code>field_credit_card</code> - Payment information</li>
54+
<li><code>field_api_key</code> - API keys or tokens</li>
55+
</ul>
56+
<p><strong>Note:</strong> The following fields are automatically excluded from logging: <code>changed</code>, <code>revision_timestamp</code>, <code>revision_uid</code>, <code>revision_log</code>. Additionally, computed and internal fields are never logged.</p>'),
57+
];
58+
59+
return parent::buildForm($form, $form_state);
60+
}
61+
62+
/**
63+
* {@inheritdoc}
64+
*/
65+
public function submitForm(array &$form, FormStateInterface $form_state) {
66+
// Convert textarea input to array.
67+
$sensitive_fields_raw = $form_state->getValue('sensitive_fields');
68+
$sensitive_fields = array_filter(
69+
array_map('trim', explode("\n", $sensitive_fields_raw)),
70+
function ($field) {
71+
return !empty($field);
72+
}
73+
);
74+
75+
$this->config('uceap_logging.settings')
76+
->set('sensitive_fields', array_values($sensitive_fields))
77+
->save();
78+
79+
parent::submitForm($form, $form_state);
80+
}
81+
82+
}

‎uceap_logging.links.task.yml‎

Lines changed: 13 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,13 @@
1+
# Create a default tab for the system logging page
2+
system.logging_settings_default:
3+
title: 'Settings'
4+
route_name: system.logging_settings
5+
base_route: system.logging_settings
6+
weight: 0
7+
8+
# Add our custom tab
9+
uceap_logging.settings:
10+
title: 'UCEAP Logging'
11+
route_name: uceap_logging.settings
12+
base_route: system.logging_settings
13+
weight: 10

‎uceap_logging.module‎

Lines changed: 2 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -116,12 +116,8 @@ function _uceap_logging_get_entity_field_changes(ContentEntityInterface $entity,
116116
];
117117

118118
// Sensitive fields that should have values masked in logs.
119-
// TODO make this configurable.
120-
$sensitive_fields = [
121-
'field_ssn',
122-
'field_confirm_ssn',
123-
'pass',
124-
];
119+
$config = \Drupal::config('uceap_logging.settings');
120+
$sensitive_fields = $config->get('sensitive_fields') ?? [];
125121

126122
$changes = [];
127123
$field_definitions = $entity->getFieldDefinitions();

‎uceap_logging.routing.yml‎

Lines changed: 7 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,7 @@
1+
uceap_logging.settings:
2+
path: '/admin/config/development/logging/uceap'
3+
defaults:
4+
_form: '\Drupal\uceap_logging\Form\LoggingSettingsForm'
5+
_title: 'Logging Settings'
6+
requirements:
7+
_permission: 'administer site configuration'

0 commit comments

Comments
 (0)