Plugins » Katello

Issue cloned from https://issues.redhat.com/browse/SAT-31304

When creating flatpak remote in Satellite, the flatpak token value from https://access.redhat.com/terms-based-registry/ is written to the production.log in plaintext. That allows any user on the Satellite system to read it.

Steps to Reproduce:
1. Generate flatpak token on https://access.redhat.com/terms-based-registry/

2. Create a flatpak remote in Satellite pointing to Redhat flatpak remote:
export FLATPAK_TOKEN="your_token"
hammer flatpak-remote create --name="Redhat flatpak" --url="https://flatpaks.redhat.io/rhel" --organization-id=1 --username="your_username" --token="$FLATPAK_TOKEN" @@

3. Search in /var/log/foreman/production.log for `https://flatpaks.redhat.io/rhel`:
$ grep https://flatpaks.redhat.io/rhel /var/log/foreman/production.log
2025-02-20T16:03:58 [I|app|40a9f219] Parameters: {"name"=>"Redhat flatpak", "url"=>"https://flatpaks.redhat.io/rhel", "organization_id"=>1, "username"=>"pmoravec's_username", "token"=>".......", "api_version"=>"v2", "flatpak_remote"=>{"name"=>"Redhat flatpak", "url"=>"https://flatpaks.redhat.io/rhel", "organization_id"=>1, "username"=>"pmoravec's_username", "token"=>".............."}}