Password for Database User in Plaintext in Trove API Log

[Auston McReynolds]

Bug #1224700 addressed the logging of passwords in plaintext on the Guest, but not the API.

Example:

{"instance": {"volume": {"size": 5}, "users": [{"password": "thepassword", "name": "theuser"}], "flavorRef": "9", "name": "thedb", "databases": [{"name": "adb"}]}} authorize /opt/stack/trove/trove/common/auth.py:67
2013-11-25 23:38:21.536 762 DEBUG routes.middleware [-] No route matched for POST /1655cf7ab12043cbae9dfe01c84753e5/instances __call__ /usr/lib/python2.7/dist-packages/routes/middleware.py:97
2013-11-25 23:38:21.538 762 DEBUG routes.middleware [-] Matched POST /1655cf7ab12043cbae9dfe01c84753e5/instances __call__ /usr/lib/python2.7/dist-packages/routes/middleware.py:100

oslo-incubator already handles this situation (https://github.com/openstack/oslo-incubator/blob/00f2b55268a4405c95ff12f67709f21803b86509/openstack/common/log.py#L52-L67), but trove's copy of log.py is out of date (see https://github.com/openstack/trove/blob/master/trove/openstack/common/log.py)

See https://github.com/openstack/nova/commit/c6d82083295e9b1b42f22d3a2d25a1ab7d341a13#diff-8023864a19c262aa58d716b065a25b1b for guidance on how to apply.

[OpenStack Infra (hudson-openstack)]

Fix proposed to branch: master
Review: https://review.openstack.org/58858

[Sushil Kumar (sushil-kumar2)]

Its a security threat on behalf of a user that his password is exposed in the logs in the flat texts.
I think we should either remove the password or somehow hide it probably masking it.

[OpenStack Infra (hudson-openstack)]

Fix proposed to branch: master
Review: https://review.openstack.org/66075

[OpenStack Infra (hudson-openstack)]

Reviewed: https://review.openstack.org/66075
Committed: https://git.openstack.org/cgit/openstack/trove/commit/?id=a65dcdd952e394bd978c615cf01b8b05736bf74d
Submitter: Jenkins
Branch: master

commit a65dcdd952e394bd978c615cf01b8b05736bf74d
Author: Khyati Sheth <email address hidden>
Date: Thu Jan 16 19:18:42 2014 -0800

    Mask database user's password in trove logs

    Currently passwords are logged in plaintext in trove-api and
    trove-taskmanager logs. This fix will mask the passwords in the logs.
    Syncing modules log, common.py from rpc and versionutils from oslo.
    common.py requires versionutils.py.

    Change-Id:I50deb003d866e85e7c7ec8ab3ce7248d1c005e57
    Closes-Bug: #1254914