russell@unturf.com
f85ccf9b99
AppConfig.__getattr__ logs raw decoded values when config keys change via Redis, including OPENAI_API_KEYS, GOOGLE_CLIENT_SECRET, and 20+ other API key/token/password PersistentConfig entries. Fix: redact values for keys matching SECRET/KEY/TOKEN/PASSWORD/CREDENTIAL denylist. 13/13 PASS
24 lines
986 B
Diff
24 lines
986 B
Diff
# UNDF: UNDF-2026-000000948
|
|
--- a/backend/open_webui/config.py
|
|
+++ b/backend/open_webui/config.py
|
|
@@ -266,10 +266,17 @@
|
|
decoded_value = json.loads(redis_value)
|
|
|
|
# Update the in-memory value if different
|
|
if self._state[key].value != decoded_value:
|
|
self._state[key].value = decoded_value
|
|
- log.info(f'Updated {key} from Redis: {decoded_value}')
|
|
+ log.info(f'Updated {key} from Redis: {_redact_config_value(key, decoded_value)}')
|
|
|
|
except json.JSONDecodeError:
|
|
log.error(f'Invalid JSON format in Redis for {key}: {redis_value}')
|
|
|
|
return self._state[key].value
|
|
+
|
|
+
|
|
+_SENSITIVE_KEY_SUBSTRINGS = ('SECRET', 'KEY', 'TOKEN', 'PASSWORD', 'CREDENTIAL')
|
|
+
|
|
+def _redact_config_value(key: str, value):
|
|
+ if any(s in key.upper() for s in _SENSITIVE_KEY_SUBSTRINGS):
|
|
+ return '***REDACTED***'
|
|
+ return value
|