From 914803b324008f757c6d194c480b40eccff26102 Mon Sep 17 00:00:00 2001
From: Natalie Rose <natalie@omg.lol>
Date: Tue, 15 Sep 2026 22:31:27 +1000
Subject: [PATCH] A little less cowboy with the password logging

---
 lib/Lacuna/RPC/Empire.pm | 13 +++++++------
 1 file changed, 7 insertions(+), 6 deletions(-)

diff --git a/lib/Lacuna/RPC/Empire.pm b/lib/Lacuna/RPC/Empire.pm
index 019675c2..f996f13c 100644
--- a/lib/Lacuna/RPC/Empire.pm
+++ b/lib/Lacuna/RPC/Empire.pm
@@ -120,7 +120,7 @@ sub login {
                                             );
         }
 
-        confess [1004, 'Password incorrect (' . $ip . ')', $password];
+        confess [1004, 'Password incorrect (' . $ip . ')'];
     }
 
     my $config = Lacuna->config;
@@ -163,7 +163,7 @@ sub benchmark {
         confess [1010, "You can't log in to an empire that has not been founded."];
     }
     unless ($empire->is_password_valid($password)) {
-        confess [1004, 'Password incorrect.', $password];            
+        confess [1004, 'Password incorrect.'];            
     }
     $out{validation} = Time::HiRes::tv_interval($t);
 
@@ -237,7 +237,7 @@ sub change_password {
     else { # backward compatibility mode
         ($current_password, $password1, $password2) = @_;
     }
-    Lacuna::Verify->new(content=>\$password1, throws=>[1001,'Invalid password.', $password1])
+    Lacuna::Verify->new(content=>\$password1, throws=>[1001,'Invalid password.'])
         ->length_gt(5)
         ->eq($password2);
 
@@ -297,7 +297,7 @@ sub reset_password {
     unless (defined $empire) {
         confess [1002, 'The key you provided is invalid. Password not reset.'];
     }
-    Lacuna::Verify->new(content=>\$password1, throws=>[1001,'Invalid password.', $password1])
+    Lacuna::Verify->new(content=>\$password1, throws=>[1001,'Invalid password.'])
         ->length_gt(5)
         ->eq($password2);
     
@@ -1343,15 +1343,16 @@ sub _rewrite_request_for_logging {
         $params->[1] = 'xxx';
     }
     elsif ($method eq 'change_password') {
-        $params->[$_] = 'xxx' for 0..2;
+        $params->[$_] = 'xxx' for 1..$#$params;
     }
     elsif ($method eq 'reset_password') {
-        $params->[$_] = 'xxx' for 1..2;
+        $params->[$_] = 'xxx' for 0..2;
     }
     elsif ($method eq 'create') {
         $params = {
             @$params,
             password => 'xxx',
+            password1 => 'xxx',
         };
     }
     elsif ($method eq 'edit_profile') {
-- 
2.51.2