All user submitted data is sent using GET requests. This is an issue as get parameters are frequently stored in webserver logs. We noticed that plain text username / passwords were stored in our apache logs and we were forced to scrub them and create a filter to explicitly remove GET request parameter logging for our openreport instance url.
Please change all forms to use POST requests to submit data. This avoids extra PI in production web server logs.
Log in to post a comment.