msRedactCredentials removes too much content especially for postgis connections about mapserver HOT 4 CLOSED

Proposed fix in #7048

from mapserver.

@PPazderski - thanks for looking into this.
MSSQL uses both pwd and password for connections depending on the database driver used.

One option could be to replace both the password and the keyword which I think would solve the issue. For example:

\SQL2019;DATABASE=msautotest;pwd=Password12!;uid=sa;

Would become something like:

\SQL2019;DATABASE=msautotest;***************;uid=sa;

This would then skip any subsequent replacements. It could also stop at a linebreak if no delimiter is found, although if the above approach is used I'm not sure if that would still be necessary.

from mapserver.

Also it does look like mysql connections in OGR use a comma separator so that combination should also probably be included.

https://gdal.org/drivers/vector/mysql.html#layer-creation-options

from mapserver.

One option could be to replace both the password and the keyword which I think would solve the issue.

Unfortunately that would not work. Imagine the case with a space in password for MSSQL. With the current code plus replacing the password= it would first replace the password until the space in the password plus the key but then the second replacement for MSSQL with semicolon delimiter would not apply anymore. E.g.

\SQL2019;DATABASE=msautotest;password=Password with space;uid=sa;

would become

\SQL2019;DATABASE=msautotest;***************** with space;uid=sa;

and the second msRedactString not find any password= anymore. When changing the order the same would apply for a postgis password containing a semicolon.

from mapserver.