passwords visible in preview

[fdrab]

Hello,

I've found past issue (#411) that should have solved this, but it seems in 3.8.0 the preview leaks fields marked as secret:

Do I have to configure something in the st2.conf? Or is this by design?

BR,
Filip

[arm4b]

This sounds like a bug indeed as secrets should be masked. Thanks for the report.

If someone is interested in contributing, the fix should be done in the st2 core which provides st2web with an API response.

[docbyte86]

Same issue while checking the past executions in the execution tab.

[fdrab]

Same issue while checking the past executions in the execution tab.

can you post example screenshot? I see secrets properly masked in past execution outputs:

If, however, you store a secret in the context and then post the whole context as output, the secret is going to be posted cleartext.