From 9a882119403c66b38a4191e3aa0c100925a549e7 Mon Sep 17 00:00:00 2001
From: Michael Sasser <Michael@MichaelSasser.org>
Date: Fri, 16 Dec 2022 06:33:40 +0100
Subject: [PATCH] fix(yaml): don't log the database password for synapse in
 debug mode

---
 matrixctl/handlers/yaml.py | 2 +-
 news/460.bugfix            | 1 +
 2 files changed, 2 insertions(+), 1 deletion(-)
 create mode 100644 news/460.bugfix

diff --git a/matrixctl/handlers/yaml.py b/matrixctl/handlers/yaml.py
index e02f6952..cb1c7473 100644
--- a/matrixctl/handlers/yaml.py
+++ b/matrixctl/handlers/yaml.py
@@ -105,7 +105,7 @@ def secrets_filter(tree: dict[str, str], key: str) -> t.Any:
     None
 
     """
-    if key in "token":
+    if key in {"token", "synapse_password"}:
         return f"<redacted length={len(tree[key])}>"
     return tree[key]
 
diff --git a/news/460.bugfix b/news/460.bugfix
new file mode 100644
index 00000000..6d9a1697
--- /dev/null
+++ b/news/460.bugfix
@@ -0,0 +1 @@
+Ensure MatrixCtl does not log the database password for synapse in debug mode