Hide passwords in debug logs

Add 6.6 branch to tests
Fix typo in test

fixes elastic#1336

.gitignore

@@ -10,6 +10,7 @@ oneliners.py
 .eggs
 .idea
 .vscode
+venvs
 Elastic.ico
 Vagrant/centos/6/.vagrant
 Vagrant/centos/7/.vagrant

.travis.yml

@@ -18,7 +18,8 @@ env:
   - ES_VERSION=6.2.4
   - ES_VERSION=6.3.2
   - ES_VERSION=6.4.3
-  - ES_VERSION=6.5.0
+  - ES_VERSION=6.5.4
+  - ES_VERSION=6.6.0
 
 os: linux
 

curator/cli.py

@@ -4,7 +4,7 @@
 import click
 from voluptuous import Schema
 from curator import actions
-from curator.config_utils import process_config
+from curator.config_utils import process_config, password_filter
 from curator.defaults import settings
 from curator.exceptions import NoIndices, NoSnapshots
 from curator.indexlist import IndexList
@@ -115,10 +115,10 @@ def run(config, action_file, dry_run=False):
     #########################################
     logger.debug('action_file: {0}'.format(action_file))
     action_config = get_yaml(action_file)
-    logger.debug('action_config: {0}'.format(action_config))
+    logger.debug('action_config: {0}'.format(password_filter(action_config)))
     action_dict = validate_actions(action_config)
     actions = action_dict['actions']
-    logger.debug('Full list of actions: {0}'.format(actions))
+    logger.debug('Full list of actions: {0}'.format(password_filter(actions)))
     action_keys = sorted(list(actions.keys()))
     for idx in action_keys:
         action = actions[idx]['action']

curator/config_utils.py

@@ -3,6 +3,7 @@
 from curator.validators import SchemaCheck, config_file
 from curator.utils import ensure_list, get_yaml, prune_nones, test_client_options
 from curator.logtools import LogInfo, Whitelist, Blacklist
+from copy import deepcopy
 
 def test_config(config):
     # Get config from yaml file
@@ -38,3 +39,16 @@ def process_config(yaml_file):
     set_logging(config['logging'])
     test_client_options(config['client'])
     return config['client']
+
+def password_filter(data):
+    """
+    Return a deepcopy of the dictionary with any password fields hidden
+    """
+    def iterdict(mydict):
+        for key, value in mydict.items():      
+            if isinstance(value, dict):
+                iterdict(value)
+            elif key == "password":
+                mydict.update({"password": "REDACTED"})
+        return mydict
+    return iterdict(deepcopy(data))

docs/Changelog.rst

@@ -14,6 +14,7 @@ Changelog
 
   * Report rollover results in both dry-run and regular runs. Requested
     in #1313 (untergeek)
+  * Hide passwords in DEBUG logs. Requested in #1336 (untergeek)
 
 5.6.0 (13 November 2018)
 ------------------------

test/integration/testvars.py

@@ -879,7 +879,7 @@
 '    description: "Delete indices as filtered"\n'
 '    action: delete_indices\n'
 '    options:\n'
-'      alllow_ilm_indices: {9}\n'
+'      allow_ilm_indices: {9}\n'
 '    filters:\n'
 '      - filtertype: {0}\n'
 '        source: {1}\n'