Version 4.6.0

system/Dispatcher/Api.php

@@ -327,6 +327,9 @@ class _Api extends \IPS\Dispatcher
 			/* Run it */
 			$controller = new $class( $this->apiKey, $this->accessToken );
 			$response = $controller->execute( $pathBits, $shouldLog );
+
+			/* Store if we need to mask anything in logs */
+			$this->parametersToMask = ( $controller->methodCalled AND isset( $controller->parametersToMask[ $controller->methodCalled ] ) ) ? $controller->parametersToMask[ $controller->methodCalled ] : NULL;
 			
 			/* Send Output */
 			$output = $response->getOutput();
@@ -345,6 +348,11 @@ class _Api extends \IPS\Dispatcher
 			$this->_respond( json_encode( array( 'errorCode' => 'EX' . $e->getCode(), 'errorMessage' => \IPS\IN_DEV ? $e->getMessage() : 'UNKNOWN_ERROR' ), JSON_PRETTY_PRINT ), 500 );
 		}
 	}
+
+	/**
+	 * @brief	Parameters to mask in logs per the controller
+	 */
+	protected $parametersToMask = NULL;
 	
 	/**
 	 * Log
@@ -358,12 +366,25 @@ class _Api extends \IPS\Dispatcher
 	{
 		try
 		{
+			$_requestData = $_REQUEST;
+
+			if( $this->parametersToMask AND \count( $this->parametersToMask ) )
+			{
+				foreach( $_requestData as $k => $v )
+				{
+					if( \in_array( $k, $this->parametersToMask ) )
+					{
+						$_requestData[ $k ] = '******';
+					}
+				}
+			}
+
 			\IPS\Db::i()->insert( 'core_api_logs', array(
 				'endpoint'			=> $this->path,
 				'method'			=> $_SERVER['REQUEST_METHOD'],
 				'api_key'			=> $this->rawApiKey,
 				'ip_address'		=> \IPS\Request::i()->ipAddress(),
-				'request_data'		=> json_encode( $_REQUEST, JSON_PRETTY_PRINT ),
+				'request_data'		=> json_encode( $_requestData, JSON_PRETTY_PRINT ),
 				'response_code'		=> $httpResponseCode,
 				'response_output'	=> $response,
 				'date'				=> time(),
@@ -387,7 +408,8 @@ class _Api extends \IPS\Dispatcher
 	 */
 	protected function _respond( $response, $httpResponseCode, $oauthError=NULL, $log=FALSE )
 	{
-		$headers = array();
+		$headers = ( mb_strtolower( $_SERVER['REQUEST_METHOD'] ) == 'get' ) ? \IPS\Output::getCacheHeaders( time(), 60 ) : \IPS\Output::getNoCacheHeaders();
+
 		if ( $this->rawAccessToken and $oauthError )
 		{
 			$headers['WWW-Authenticate'] = "Bearer error=\"{$oauthError}\"";