mod_auth_internal_plain: Don't log passwords, even at debug level

diff --git a/plugins/mod_auth_internal_plain.lua b/plugins/mod_auth_internal_plain.lua
index e411c4f7d7f5b429121268008539604b0a44f95a..d226fdbefa5cb2adbd6ef443457751941f5272c7 100644 (file)
--- a/plugins/mod_auth_internal_plain.lua
+++ b/plugins/mod_auth_internal_plain.lua
@@ -19,7 +19,7 @@ local provider = {};
 log("debug", "initializing internal_plain authentication provider for host '%s'", host);
 
 function provider.test_password(username, password)
-       log("debug", "test password '%s' for user %s at host %s", password, username, host);
+       log("debug", "test password for user %s at host %s", username, host);
        local credentials = accounts:get(username) or {};
 
        if password == credentials.password then