From 8bc89757a768c922dfa2ea52b1a75954ae6aa2fe Mon Sep 17 00:00:00 2001
From: Jamie Cameron <jcameron@webmin.com>
Date: Sun, 11 Oct 2026 18:03:22 -0700
Subject: [PATCH] Only log hashed session ID, so it cannot be used to login

---
 web-lib-funcs.pl | 10 +++++++++-
 1 file changed, 9 insertions(+), 1 deletion(-)

diff --git a/web-lib-funcs.pl b/web-lib-funcs.pl
index 1b3954017..f32ce3983 100755
--- a/web-lib-funcs.pl
+++ b/web-lib-funcs.pl
@@ -7696,6 +7696,14 @@ return if ($gconfig{'logmodules'} && &indexof($m,
        split(/\s+/, $gconfig{'logmodules'})) < 0);
 
 # log the action
+my $sid = $main::session_id;
+if ($sid && &foreign_check("acl")) {
+	&foreign_require("acl");
+	$sid = &acl::hash_session_id($sid);
+	}
+else {
+	$sid = undef;
+	}
 my $now = time();
 my @tm = localtime($now);
 my $id = sprintf "%d.%d.%d", $now, $$, $main::action_id_count;
@@ -7706,7 +7714,7 @@ my $line = sprintf "%s [%2.2d/%s/%4.4d %2.2d:%2.2d:%2.2d] %s %s %s %s %s \"%s\"
     $id, $tm[3], ucfirst($number_to_month_map{$tm[4]}), $tm[5]+1900,
     $tm[2], $tm[1], $tm[0],
     $remote_user || '-',
-    $main::session_id || '-',
+    $sid || '-',
     $param_client_ip || $ENV{'REMOTE_HOST'} || '-',
     $m,
     $param_host ? $param_host.':'.$param_script_on_host :