avoid logging dummy password

2 files changed, 10 insertions, 1 deletions

diff --git a/mail/changes/bug_3416-do-not-log-pass b/mail/changes/bug_3416-do-not-log-pass
new file mode 100644
index 00000000..137b7a3c
--- /dev/null
+++ b/mail/changes/bug_3416-do-not-log-pass
@@ -0,0 +1 @@
+  o Avoid logging dummy password on imap server. Closes: #3416
diff --git a/mail/src/leap/mail/imap/service/imap.py b/mail/src/leap/mail/imap/service/imap.py
index a4ffed6c..1a8c15cf 100644
--- a/mail/src/leap/mail/imap/service/imap.py
+++ b/mail/src/leap/mail/imap/service/imap.py
@@ -17,6 +17,8 @@
 """
 Imap service initialization
 """
+from copy import copy
+
 import logging
 logger = logging.getLogger(__name__)
 
@@ -71,7 +73,13 @@ class LeapIMAPServer(imap4.IMAP4Server):
         #self.theAccount = theAccount
 
     def lineReceived(self, line):
-        log.msg('rcv: %s' % line)
+        if "login" in line:
+            # avoid to log the pass, even though we are using a dummy auth
+            # by now.
+            msg = line[:7] + " [...]"
+        else:
+            msg = copy(line)
+        log.msg('rcv: %s' % msg)
         imap4.IMAP4Server.lineReceived(self, line)
 
     def authenticateLogin(self, username, password):