Add show_diff parameter to prevent credentials leaks.

camilo-schoeningh-sociomantic · camilo-schoeningh-sociomantic · commit caa356a6790a · 2018-08-09T12:14:16.000+02:00
diff --git a/manifests/init.pp b/manifests/init.pp
@@ -76,6 +76,7 @@
   Boolean $automatic_dlo_cleanup     = $puppetdb::params::automatic_dlo_cleanup,
   String[1] $cleanup_timer_interval  = $puppetdb::params::cleanup_timer_interval,
   Integer[1] $dlo_max_age            = $puppetdb::params::dlo_max_age,
+  Boolean $show_password             = $puppetdb::params::show_password,
 ) inherits puppetdb::params {
 
   class { '::puppetdb::server':
@@ -150,6 +151,7 @@
     automatic_dlo_cleanup             => $automatic_dlo_cleanup,
     cleanup_timer_interval            => $cleanup_timer_interval,
     dlo_max_age                       => $dlo_max_age,
+    show_password                     => $show_password,
   }
 
   if ($database == 'postgres') {
diff --git a/manifests/master/storeconfigs.pp b/manifests/master/storeconfigs.pp
@@ -12,9 +12,9 @@
   }
 
   Ini_setting {
+    ensure  => present,
     section => $puppet_conf_section,
     path    => $puppet_conf,
-    ensure  => present,
   }
 
   ini_setting { "puppet.conf/${puppet_conf_section}/storeconfigs":
diff --git a/manifests/params.pp b/manifests/params.pp
@@ -13,6 +13,7 @@
   $cipher_suites             = undef
   $open_ssl_listen_port      = undef
   $postgres_listen_addresses = 'localhost'
+  $show_password             = false
 
   $puppetdb_version          = $puppetdb::globals::version
   $database                  = $puppetdb::globals::database
diff --git a/manifests/server.pp b/manifests/server.pp
@@ -71,6 +71,7 @@
   Boolean $automatic_dlo_cleanup          = $puppetdb::params::automatic_dlo_cleanup,
   String[1] $cleanup_timer_interval       = $puppetdb::params::cleanup_timer_interval,
   Integer[1] $dlo_max_age                 = $puppetdb::params::dlo_max_age,
+  Boolean $show_password                  = $puppetdb::params::show_password,
 ) inherits puppetdb::params {
 
   # Apply necessary suffix if zero is specified.
@@ -176,6 +177,7 @@
     confdir                => $confdir,
     puppetdb_user          => $puppetdb_user,
     puppetdb_group         => $puppetdb_group,
+    show_password          => $show_password,
     notify                 => Service[$puppetdb_service],
   }
 
@@ -197,6 +199,7 @@
     puppetdb_group         => $puppetdb_group,
     notify                 => Service[$puppetdb_service],
     database_max_pool_size => $read_database_max_pool_size,
+    show_password          => $show_password,
   }
 
   if $ssl_deploy_certs {
@@ -248,6 +251,7 @@
     notify             => Service[$puppetdb_service],
     puppetdb_user      => $puppetdb_user,
     puppetdb_group     => $puppetdb_group,
+    show_password      => $show_password,
   }
 
   class { 'puppetdb::server::puppetdb':
diff --git a/manifests/server/command_processing.pp b/manifests/server/command_processing.pp
@@ -11,8 +11,8 @@
 
   # Set the defaults
   Ini_setting {
-    path    => $config_ini,
     ensure  => 'present',
+    path    => $config_ini,
     section => 'command-processing',
     require => File[$config_ini],
   }
diff --git a/manifests/server/database.pp b/manifests/server/database.pp
@@ -21,6 +21,7 @@
   $puppetdb_user          = $puppetdb::params::puppetdb_user,
   $puppetdb_group         = $puppetdb::params::puppetdb_group,
   $database_max_pool_size = $puppetdb::params::database_max_pool_size,
+  $show_password          = $puppetdb::params::show_password,
 ) inherits puppetdb::params {
 
   if str2bool($database_validate) {
@@ -58,8 +59,8 @@
   }
   # Set the defaults
   Ini_setting {
-    path    => $database_ini,
     ensure  => present,
+    path    => $database_ini,
     section => 'database',
     require => $ini_setting_require
   }
@@ -91,8 +92,9 @@
 
     if $database_password != undef {
       ini_setting {'puppetdb_psdatabase_password':
-        setting => 'password',
-        value   => $database_password,
+        setting       => 'password',
+        value         => $database_password,
+        show_password => $show_password,
       }
     }
   }
diff --git a/manifests/server/global.pp b/manifests/server/global.pp
@@ -17,10 +17,10 @@
 
   # Set the defaults
   Ini_setting {
-    path    => $config_ini,
-    ensure  => 'present',
-    section => 'global',
-    require => File[$config_ini],
+    ensure    => 'present',
+    path      => $config_ini,
+    section   => 'global',
+    require   => File[$config_ini],
   }
 
   if $vardir {
diff --git a/manifests/server/jetty.pp b/manifests/server/jetty.pp
@@ -16,6 +16,7 @@
   $max_threads                    = $puppetdb::params::max_threads,
   $puppetdb_user                  = $puppetdb::params::puppetdb_user,
   $puppetdb_group                 = $puppetdb::params::puppetdb_group,
+  $show_password                  = $puppetdb::params::show_password,
 ) inherits puppetdb::params {
 
   $jetty_ini = "${confdir}/jetty.ini"
@@ -29,8 +30,8 @@
 
   # Set the defaults
   Ini_setting {
-    path    => $jetty_ini,
     ensure  => present,
+    path    => $jetty_ini,
     section => 'jetty',
     require => File[$jetty_ini],
   }
@@ -90,9 +91,10 @@
   if $ssl_set_cert_paths {
     # assume paths have been validated in calling class
     ini_setting { 'puppetdb_ssl_key':
-      ensure  => present,
-      setting => 'ssl-key',
-      value   => $ssl_key_path,
+      ensure        => present,
+      setting       => 'ssl-key',
+      value         => $ssl_key_path,
+      show_password => $show_password,
     }
     ini_setting { 'puppetdb_ssl_cert':
       ensure  => present,
diff --git a/manifests/server/puppetdb.pp b/manifests/server/puppetdb.pp
@@ -19,8 +19,8 @@
 
   # Set the defaults
   Ini_setting {
-    path    => $puppetdb_ini,
     ensure  => present,
+    path    => $puppetdb_ini,
     section => 'puppetdb',
     require => File[$puppetdb_ini],
   }
diff --git a/manifests/server/read_database.pp b/manifests/server/read_database.pp
@@ -16,6 +16,7 @@
   $puppetdb_user          = $puppetdb::params::puppetdb_user,
   $puppetdb_group         = $puppetdb::params::puppetdb_group,
   $database_max_pool_size = $puppetdb::params::read_database_max_pool_size,
+  $show_password          = $puppetdb::params::show_password,
 ) inherits puppetdb::params {
 
   # Only add the read database configuration if database host is defined.
@@ -55,8 +56,8 @@
     }
     # Set the defaults
     Ini_setting {
-      path    => $read_database_ini,
       ensure  => present,
+      path    => $read_database_ini,
       section => 'read-database',
       require => $ini_setting_require,
     }
@@ -81,8 +82,9 @@
 
       if $database_password != undef {
         ini_setting { 'puppetdb_read_database_password':
-          setting => 'password',
-          value   => $database_password,
+          setting       => 'password',
+          value         => $database_password,
+          show_password => $show_password,
         }
       }
     }

Original file line number	Diff line number	Diff line change
`@@ -12,9 +12,9 @@`
`12`	`12`	`}`
`13`	`13`
`14`	`14`	`Ini_setting {`
	`15`	`+ ensure => present,`
`15`	`16`	`section => $puppet_conf_section,`
`16`	`17`	`path => $puppet_conf,`
`17`		`- ensure => present,`
`18`	`18`	`}`
`19`	`19`
`20`	`20`	`ini_setting { "puppet.conf/${puppet_conf_section}/storeconfigs":`
Original file line number	Diff line number	Diff line change
`@@ -11,8 +11,8 @@`
`11`	`11`
`12`	`12`	`# Set the defaults`
`13`	`13`	`Ini_setting {`
`14`		`- path => $config_ini,`
`15`	`14`	`ensure => 'present',`
	`15`	`+ path => $config_ini,`
`16`	`16`	`section => 'command-processing',`
`17`	`17`	`require => File[$config_ini],`
`18`	`18`	`}`
Original file line number	Diff line number	Diff line change
`@@ -21,6 +21,7 @@`
`21`	`21`	`$puppetdb_user = $puppetdb::params::puppetdb_user,`
`22`	`22`	`$puppetdb_group = $puppetdb::params::puppetdb_group,`
`23`	`23`	`$database_max_pool_size = $puppetdb::params::database_max_pool_size,`
	`24`	`+ $show_password = $puppetdb::params::show_password,`
`24`	`25`	`) inherits puppetdb::params {`
`25`	`26`
`26`	`27`	`if str2bool($database_validate) {`
`@@ -58,8 +59,8 @@`
`58`	`59`	`}`
`59`	`60`	`# Set the defaults`
`60`	`61`	`Ini_setting {`
`61`		`- path => $database_ini,`
`62`	`62`	`ensure => present,`
	`63`	`+ path => $database_ini,`
`63`	`64`	`section => 'database',`
`64`	`65`	`require => $ini_setting_require`
`65`	`66`	`}`
`@@ -91,8 +92,9 @@`
`91`	`92`
`92`	`93`	`if $database_password != undef {`
`93`	`94`	`ini_setting {'puppetdb_psdatabase_password':`
`94`		`- setting => 'password',`
`95`		`- value => $database_password,`
	`95`	`+ setting => 'password',`
	`96`	`+ value => $database_password,`
	`97`	`+ show_password => $show_password,`
`96`	`98`	`}`
`97`	`99`	`}`
`98`	`100`	`}`
Original file line number	Diff line number	Diff line change
`@@ -19,8 +19,8 @@`
`19`	`19`
`20`	`20`	`# Set the defaults`
`21`	`21`	`Ini_setting {`
`22`		`- path => $puppetdb_ini,`
`23`	`22`	`ensure => present,`
	`23`	`+ path => $puppetdb_ini,`
`24`	`24`	`section => 'puppetdb',`
`25`	`25`	`require => File[$puppetdb_ini],`
`26`	`26`	`}`
Original file line number	Diff line number	Diff line change
`@@ -16,6 +16,7 @@`
`16`	`16`	`$puppetdb_user = $puppetdb::params::puppetdb_user,`
`17`	`17`	`$puppetdb_group = $puppetdb::params::puppetdb_group,`
`18`	`18`	`$database_max_pool_size = $puppetdb::params::read_database_max_pool_size,`
	`19`	`+ $show_password = $puppetdb::params::show_password,`
`19`	`20`	`) inherits puppetdb::params {`
`20`	`21`
`21`	`22`	`# Only add the read database configuration if database host is defined.`
`@@ -55,8 +56,8 @@`
`55`	`56`	`}`
`56`	`57`	`# Set the defaults`
`57`	`58`	`Ini_setting {`
`58`		`- path => $read_database_ini,`
`59`	`59`	`ensure => present,`
	`60`	`+ path => $read_database_ini,`
`60`	`61`	`section => 'read-database',`
`61`	`62`	`require => $ini_setting_require,`
`62`	`63`	`}`
`@@ -81,8 +82,9 @@`
`81`	`82`
`82`	`83`	`if $database_password != undef {`
`83`	`84`	`ini_setting { 'puppetdb_read_database_password':`
`84`		`- setting => 'password',`
`85`		`- value => $database_password,`
	`85`	`+ setting => 'password',`
	`86`	`+ value => $database_password,`
	`87`	`+ show_password => $show_password,`
`86`	`88`	`}`
`87`	`89`	`}`
`88`	`90`	`}`