FEATURE: Configuration module secret scrubbing

Neos.Neos/Classes/Controller/Module/Administration/ConfigurationController.php

@@ -19,6 +19,7 @@
 use Neos\Flow\Configuration\ConfigurationSchemaValidator;
 use Neos\Flow\Configuration\Exception\SchemaValidationException;
 use Neos\Neos\Controller\Module\ModuleTranslationTrait;
+use Neos\Utility\Arrays;
 use Neos\Utility\SchemaGenerator;
 use Neos\Neos\Controller\Module\AbstractModuleController;
 use Neos\Error\Messages\Message;
@@ -61,7 +62,11 @@ public function indexAction($type = 'Settings')
         ]);
 
         if (in_array($type, $availableConfigurationTypes)) {
-            $this->view->assign('configuration', $this->configurationManager->getConfiguration($type));
+            $this->view->assign('configuration', self::scrubConfiguredSecrets(
+                $this->configurationManager->getConfiguration($type),
+                $this->moduleConfiguration['settings']['automaticSecretScrubbingPattern'] ?? null,
+                $this->moduleConfiguration['settings']['configurationPathsWithSecrets'][$type] ?? []
+            ));
 
             try {
                 $this->view->assign('validationResult', $this->configurationSchemaValidator->validate($type));
@@ -84,4 +89,32 @@ public function indexAction($type = 'Settings')
             );
         }
     }
+
+    public static function scrubConfiguredSecrets(array $configuration, ?string $automaticSecretScrubbingPattern, array $pathsToBeScrubbed, string $currentPathPrefix = ''): array
+    {
+        $scrubbedConfiguration = $configuration;
+        foreach ($scrubbedConfiguration as $key => $value) {
+            $path = $currentPathPrefix . $key;
+            if (is_array($value)) {
+                $scrubbedConfiguration[$key] = self::scrubConfiguredSecrets($value, $automaticSecretScrubbingPattern, $pathsToBeScrubbed, $path . '.');
+                continue;
+            }
+
+            if (in_array($path, $pathsToBeScrubbed, true)) {
+                // If the path is in the list of paths to be scrubbed, replace the value with '***'
+                $scrubbedConfiguration[$key] = '***';
+                continue;
+            }
+
+            if ($automaticSecretScrubbingPattern && preg_match(
+                $automaticSecretScrubbingPattern,
+                    (string)$key
+            )) {
+                // If the key matches the automatic secret scrubbing pattern, replace the value with '***'
+                $scrubbedConfiguration[$key] = '***';
+            }
+        }
+
+        return $scrubbedConfiguration;
+    }
 }

Neos.Neos/Configuration/Settings.yaml

@@ -379,6 +379,24 @@ Neos:
             description: 'Neos.Neos:Modules:configuration.description'
             icon: fas fa-list-alt
             mainStylesheet: 'Lite'
+            settings:
+              #
+              # This pattern is matched against the last part of a configuration path
+              # e.g. '/^(password|secret)$/' will lead to any path with the last part containing 'password' or 'secret'
+              # being scrubbed before displaying in the backend.
+              #
+              automaticSecretScrubbingPattern: '/^(password|secret)$/'
+              #
+              # Here you can additionally define explicit paths by configuration type
+              # that contain secrets and should be scrubbed before displaying
+              # e.g.:
+              #  configurationPathsWithSecrets:
+              #    Settings:
+              #      - Neos.Flow.persistence.backendOptions.dbname
+              #
+              configurationPathsWithSecrets:
+                Settings:
+                  - Neos.Flow.persistence.backendOptions.dbname
           dimensions:
             label: 'Neos.Neos:Modules:dimensions.label'
             controller: 'Neos\Neos\Controller\Module\Administration\DimensionController'

Neos.Neos/Resources/Private/Fusion/Backend/Views/Login.fusion → Neos.Neos/Resources/Private/Fusion/Backend/Login/Login.fusion

@@ -146,3 +146,10 @@ prototype(Neos.Neos:Component.Login.Form) < prototype(Neos.Fusion:Component) {
     </Neos.Fusion.Form:Form>
   `
 }
+
+Neos.Neos.LoginController.index = Neos.Neos:View.Login {
+  site = ${site}
+  styles = ${styles}
+  username = ${username}
+  flashMessages = ${flashMessages}
+}

Neos.Neos/Resources/Private/Fusion/Backend/Root.fusion

@@ -1,11 +1,6 @@
 include: resource://Neos.Fusion/Private/Fusion/Root.fusion
 include: resource://Neos.Fusion.Form/Private/Fusion/Root.fusion
 include: resource://Neos.Neos/Private/Fusion/SharedCoreComponents/*
-include: Views/*.fusion
-
-Neos.Neos.LoginController.index = Neos.Neos:View.Login {
-  site = ${site}
-  styles = ${styles}
-  username = ${username}
-  flashMessages = ${flashMessages}
-}
+include: resource://Neos.Neos/Private/Fusion/*
+include: resource://Neos.Workspace.Ui/Private/Fusion/*
+include: **/*