Allow not saving sensitive information from diffs

Created on 22 April 2025, 3 days ago

Problem/Motivation

Currently, log entity operations allows to save diffs on each entity save. This diff stores the field values that have changed.

In order to manage sensitive information, it is required to provide a solution that do not saves sensitive information.

Now, if we save diffs for an entity , it will save all its information without filters. Examples:

- Saving users will save the user password in diffs. This password is encrypted and not raw, but it is still dangerous.
- Saving payment information from commerce payment may allow saving the credit card information.

Steps to reproduce

Enable log_entity_operations and log_entity_operations entity and enable user entity to be logged.

Proposed resolution

We need a flexible solution that allows manage known use cases (user password, address city, etc), and also custom use cases. Example: field_city created in a content type.

For this, this solution may fit our needs:

- For each entity type enabled to be logged, show a field named 'Sanitize' with a list of checkboxes. Each checkbox is a field / property of the entity. Then, if that checkbox is enabled, that field will be sanitized from database. At a first approach, we can fully replace the content with ****. With this, developers may configure which fields they need to be sanitized.

For the user entity, the configuration would look like this:

[ ] Name
[ ] Surname
[X] Email
[X] Password
...

- With these checkboxes, we can auto-enable some fields that are considered they must always be sanitized. For example: email and pass fields from user entity must be always checked.

- Provide a hook update to enable this configuration in sites already using this module.

Feature request
Status

Active

Version

1.0

Component

Code

Created by

🇪🇸Spain omarlopesino

Live updates comments and jobs are added and updated live.
Sign in to follow issues

Comments & Activities

  • Issue created by @omarlopesino
  • 🇮🇳India nikunjkotecha India, Gujarat, Rajkot

    This looks great but probably a final solution, to begin with let's implement hook_alter in below files before we actually log so developers can add code to sanitise fields they want and in a way they want (full / partial / etc.) ?

    If you agree we can keep this ticket as is and add the smaller scope in another ticket. This ticket would be really handy for people not doing any code or very little code, however projects interested in logs are mostly developer friendly projects :)

  • 🇨🇭Switzerland florianmuellerch Aarau, Switzerland

    The most important aspect in my case is that it is configurable weather to redact any information at all, and maybe even what info to redact.
    For example, I could have use cases where I want to protocol sensitive actions, where I fully need the info such as full emails, maybe even credit card numbers for legal reasons for a certain amount of time. The responsibility should lie with the site maintainer. We could opt for a setting "Redact sensitive information" that defaults to true, but is still disableable.

  • 🇪🇸Spain omarlopesino

    Thanks both for the feedback!

    About #1: Adding a hook will allow developers quickly sanitizing the values, meanwhile we prepare a definitive solution. It would also let developers add custom logic to the redaction, as maybe it needs some dynamic calculation, or a specific way to redact it.

    This approach would help users less familiarized with module development / those who want to provide this redact configuration through recipes.

    I will open a new issue for adding the hooks to alter diffs, independent on the purpose.

    About #2: I agree as it will help to easily switch on and off the redaction. That can be saved into Drupal state, so it does not need deployments.

Production build 0.71.5 2024