This website uses cookies. By clicking Accept, you consent to the use of cookies. Click Here to learn more about how we use cookies.
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
- Revenera Community
- :
- InstallShield
- :
- InstallShield Forum
- :
- Re: Preventing passwords from getting written to log files
Subscribe
- Mark Topic as New
- Mark Topic as Read
- Float this Topic for Current User
- Subscribe
- Mute
- Printer Friendly Page
- Mark as New
- Subscribe
- Mute
- Permalink
- Report Inappropriate Content
‎Nov 23, 2015
07:40 AM
Preventing passwords from getting written to log files
Hi
I have a Basic MSI project and a slight dilemma there. I'd need to ask user credentials during the UI phase and pass them to a custom action in the execute phase to be handled. However, doing that the normal way using CustomActionData would cause those credentials (especially the password) to be written to the MSI log file. I wouldn't like to disable MSI logging as that provides useful troubleshooting information but having passwords there is an obvious security issue. Is there a way to prevent certain data from being written to the log in clear text? Or do I have to write a separate application that's launched during the execute phase to request those credentials?
I have a Basic MSI project and a slight dilemma there. I'd need to ask user credentials during the UI phase and pass them to a custom action in the execute phase to be handled. However, doing that the normal way using CustomActionData would cause those credentials (especially the password) to be written to the MSI log file. I wouldn't like to disable MSI logging as that provides useful troubleshooting information but having passwords there is an obvious security issue. Is there a way to prevent certain data from being written to the log in clear text? Or do I have to write a separate application that's launched during the execute phase to request those credentials?
(5) Replies
- Mark as New
- Subscribe
- Mute
- Permalink
- Report Inappropriate Content
‎Nov 23, 2015
01:40 PM
Have you considered using the MsiHiddenProperties property?
- Mark as New
- Subscribe
- Mute
- Permalink
- Report Inappropriate Content
‎Nov 23, 2015
01:57 PM
hidenori wrote:
Have you considered using the MsiHiddenProperties property?
I forgot about that one, it's just the thing I need! Thanks 🙂
- Mark as New
- Subscribe
- Mute
- Permalink
- Report Inappropriate Content
‎Nov 24, 2015
04:11 AM
Unfortunately there's a little problem with that. Even though I've hidden the actual property containing the password as well as the property used for passing custom action data, it's still written to the log at this point:
[CODE]MSI (s) (E4:A8) [12:05:59:540]: Executing op: CustomActionSchedule(Action=CreatePasswordAlias,ActionType=3073,Source=BinaryData,Target=f10,CustomActionData=)[/CODE]
Any ideas on how to solve this one?
[CODE]MSI (s) (E4:A8) [12:05:59:540]: Executing op: CustomActionSchedule(Action=CreatePasswordAlias,ActionType=3073,Source=BinaryData,Target=f10,CustomActionData=
Any ideas on how to solve this one?
- Mark as New
- Subscribe
- Mute
- Permalink
- Report Inappropriate Content
‎Nov 24, 2015
08:51 AM
You may also want to try the Custom Action Hidden Target Option. InstallShield currently does not expose the setting in the Custom Actions view. In the Direct Editor, you need to add 0x2000 (8192) to the type of your custom action that you want to prevent from writing the value in the Target column into the log file.
- Mark as New
- Subscribe
- Mute
- Permalink
- Report Inappropriate Content
‎Nov 25, 2015
12:37 AM
Thanks again hidenori, seems to work fine once again 🙂
![](/skins/images/8C9D13A71C7F7695F3262372C0172D68/responsive_peak/images/icon_anonymous_message.png)