Hi,
I can see the reasoning behing stripping tags form the message () but on the other hand this method should allow other embedded types of tags in the message body. Therefore I suggest stripping only tags maybe?

Comments

andreiashu’s picture

StatusFileSize
new2.45 KB

I think a better solution would be to not put the log message body through format_string() function which t() uses. The attached patch provides a clone of t() with the only exception that log4php_t() skips calling format_string.

andreiashu’s picture

Status: Active » Needs review
andreiashu’s picture

Title: strip_trags in hook_watchdog() implementation » hook_watchdog() implementation should not use format_string()

better title?

andreiashu’s picture

StatusFileSize
new2.45 KB

added '// Construct plain-text message' back :)

erikwebb’s picture

Status: Needs review » Needs work

What's the danger of format_string()? If we're trying to keep some tags, why not just change the sanitization to !variable? This information is never available through Drupal, so I don't believe there's a security issue in that. I think this is a more manageable approach that replacing the t() function.

On a separate note, I suppose we should actually use get_t() in case the database isn't available yet.

andreiashu’s picture

I'm not sure I understand "why not just change the sanitization to !variable?"
All messages that come from core and contrib will have % or @ or ! in them. You can't change that.
Do you suggest replacing all '@' and '%' to '!variable' in log4php watchdog implementation? I would not like to do that to be honest

erikwebb’s picture

Just looking through my dblog, there are examples of other modules logging rich messages. Are you having this problem with some modules in particular? I'm inclined to just follow whatever formatting the original module set.

andreiashu’s picture

Hi Erik,

I gave this issue a bit more thought and I think you might be (partially) right :)

I'l like to step back and reiterate (even though we already know this) what the default logging (dblog module) system does:

  • it takes care of the both creating and displaying of the logs
  • it uses t() function in order to get 2 things done: translatable logging messages and escapes the %, @ and ! "tokens" that exist within the message for security reasons.

Regarding displaying of the messages, DBlog's approach works just fine when all you want to do is see your messages in the browser.
Obviously, when you want to tail your logs within a file (within a terminal) this approach doesn't work well which is what the initial patch was trying to fix.
Now, the additional issue we face is that Log4PHP can have appenders to any kind of source so we should take that into consideration.

Considering the above I think it might be a good idea to try and let the user/sysadmin decide how he/she wants this module to behave. So I reckon providing a sane default with the option to customise would be the best of both worlds instead of hardcoding it as per my patch, or doing strip_tags on the message before inserting it as current code does.

I'll provide a patch soon, until then let me know if this approach makes any sense.

erikwebb’s picture

I like your idea. Have a default implementation that can be overridden by another module. This is basically how the theme system works, but I obviously don't want to use the theme system for this module. How would you recommend using this and configuring? Documented settings.php variable? Some sort of basic UI? (I'd rather not have a UI for this module, since the whole point is to bring logging outside of Drupal.)

andreiashu’s picture

I was thinking that we can provide different log4php Layouts for this that will deal with formatting/stripping of the message.The user of the module would then only reference the relevant Layout in their log4php.xml file.

From what I can see custom modules can use $conf['log4php_config'] at hook_init() time (as long as they are loaded before log4php module) to alter that config during run time. I don't like globals like that but for the time being it works and (unfortunately) it is a Drupal thing so module developers will be aware of it.

erikwebb’s picture

So should we create a Drupal-friendly Layout to start with and simply recommend that?

andreiashu’s picture

Yes that should work. I'll try and do it this weekend, but I don't mind if you beat me to it :)

andreiashu’s picture

Assigned: Unassigned » andreiashu

That was a looong weekend :)
Assigning to myself so I can take of it soon

andreiashu’s picture

Title: hook_watchdog() implementation should not use format_string() » Provide watchdog aware renderers
Status: Needs work » Needs review
StatusFileSize
new4.95 KB

Attached patch provides renderers that are Drupal aware. It also sets the default renderer to LoggerRendererDrupalPlainLocaleObject which will do what the patch in comment #4 did: log a localised version of the message without passing the message through format_string().

andreiashu’s picture

StatusFileSize
new9.38 KB

Oops I forgot to add the renderers to the patch. This one is the correct thing

erikwebb’s picture

Status: Needs review » Fixed
andreiashu’s picture

Status: Fixed » Needs work

Hey Erik,

I downloaded the stable build archive and it doesn't contain the includes directory
I think you might have merged the patch from #14rather than #15 which actually contains the renderer files.

erikwebb’s picture

Status: Needs work » Fixed

Sorry about that. Must have pulled your patch before the second one was posted.

https://drupal.org/node/1814450

Status: Fixed » Closed (fixed)

Automatically closed -- issue fixed for 2 weeks with no activity.

Anonymous’s picture

Issue summary: View changes

typo