gfpdf_logging_redact_keys

Description

Gravity PDF redacts sensitive values from its logs before they're written. This filter lets you add extra keys to the redaction list.

Matching is done on the log context's array/object keys, is case-insensitive, and recurses into nested arrays and objects. This means adding my_api_key also redacts ['response']['body']['my_api_key']. Matched values are replaced with [redacted].

The following keys are always redacted and cannot be removed:

license, edd_license_key, package, download_link, access_token, refresh_token, authorization, password, secret, token, cookie, set-cookie, nonce

Gravity PDF also redacts secrets found in the log message itself using pattern matching (license-key and signature shapes, bearer tokens, and URL query strings). That behaviour isn't affected by this filter.

note

This filter is additive only. The array you return is merged over the defaults above. Any value in the returned array that isn't a string is discarded.

Version

This filter was introduced in Gravity PDF 6.16.0.

Parameters

$keys | array

• The list of keys to redact, pre-populated with the default keys listed above

$slug | string

• The slug of the logger doing the redaction. Gravity PDF core uses gravity-pdf, and extensions use their own slug e.g. gravity-pdf-core-booster

Usage

This snippet redacts two additional keys from every Gravity PDF log:

add_filter( 'gfpdf_logging_redact_keys', function( $keys, $slug ) {
    $keys[] = 'x_api_signature';
    $keys[] = 'customer_email';

    return $keys;
}, 10, 2 );

Use the $slug parameter if you only want the extra keys applied to the logs of a specific extension.

Source Code

This filter is located in the Redact_Processor::__construct() method of /src/Helper/Log/Redact_Processor.php.