From 3359912c2315c9c7a1d35f2c6299383ac807aee4 Mon Sep 17 00:00:00 2001
From: Ewa Soroka <ewa.soroka@enovation.ie>
Date: Fri, 14 Aug 2026 10:50:21 +0200
Subject: [PATCH] Stop logging submitted master passwords

---
 auth.php | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/auth.php b/auth.php
index 84fd15b..e3ff4c6 100644
--- a/auth.php
+++ b/auth.php
@@ -197,7 +197,7 @@ private function is_master_password($userpassword) {
                     $this->log(__FUNCTION__ . " - IP address is not in the whitelist: ". getremoteaddr());
                 }
             } else {
-                $this->log(__FUNCTION__ . " - is not master password or has been expired: '{$userpassword}'");
+                $this->log(__FUNCTION__ . ' - submitted master password is invalid or has expired');
             }
         } else {
             $this->log(__FUNCTION__ . " - master password is not enabled in config.php");