From a72e525bad2e4336faea1cfdd00710131e933033 Mon Sep 17 00:00:00 2001 From: Riddhesh Sanghvi Date: Mon, 12 Oct 2026 12:19:14 +0530 Subject: [PATCH 1/2] fix(site): keep PHP site database credentials out of the log The database and database root passwords are registered with EE::obfuscate() when core provides it, and 'ee site info --format=json' prints the site row without writing it to the log. --- src/PHP.php | 7 ++++++- 1 file changed, 6 insertions(+), 1 deletion(-) diff --git a/src/PHP.php b/src/PHP.php index 6d7e368..883fe39 100644 --- a/src/PHP.php +++ b/src/PHP.php @@ -277,6 +277,10 @@ public function create( $args, $assoc_args ) { } $this->site_data['db_root_password'] = ( 'db' === $this->site_data['db_host'] ) ? \EE\Utils\random_password() : ''; + // Keeps the generated credentials out of the logged commands and their output. + if ( method_exists( 'EE', 'obfuscate' ) ) { + EE::obfuscate( [ $this->site_data['db_password'], $this->site_data['db_root_password'] ] ); + } if ( GLOBAL_DB === $this->site_data['db_host'] ) { \EE\Service\Utils\init_global_container( GLOBAL_DB ); @@ -364,7 +368,8 @@ public function info( $args, $assoc_args ) { if ( 'json' === $format ) { $site = (array) Site::find( $this->site_data['site_url'] ); $site = reset( $site ); - EE::log( json_encode( $site ) ); + // Printed for the user only: it holds the site's credentials. + EE::line( json_encode( $site ) ); return; } From d87715fac64370738b358c77795690d4f87d153f Mon Sep 17 00:00:00 2001 From: Riddhesh Sanghvi Date: Mon, 12 Oct 2026 12:28:30 +0530 Subject: [PATCH 2/2] ci(behat): read the EasyEngine logs as root The logs directory is now created readable by root only, so the log output step reads it with sudo. --- .github/workflows/test_and_build.yml | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-) diff --git a/.github/workflows/test_and_build.yml b/.github/workflows/test_and_build.yml index a7a4a0b..f8fce96 100644 --- a/.github/workflows/test_and_build.yml +++ b/.github/workflows/test_and_build.yml @@ -88,6 +88,7 @@ jobs: - name: Output logs if: ${{ always() }} run: | - [[ -f "/opt/easyengine/logs/install.log" ]] && cat /opt/easyengine/logs/install.log || echo 'No install log.' - [[ -f "/opt/easyengine/logs/ee.log" ]] && cat /opt/easyengine/logs/ee.log || echo 'No run log.' + # The logs directory is readable by root only. + sudo test -f /opt/easyengine/logs/install.log && sudo cat /opt/easyengine/logs/install.log || echo 'No install log.' + sudo test -f /opt/easyengine/logs/ee.log && sudo cat /opt/easyengine/logs/ee.log || echo 'No run log.'