Security fixes

Author: MrAdder

README.md

@@ -56,7 +56,9 @@ public function panel(Panel $panel): Panel
 }
 ```
 ## Authorization
-To enforce policies on `ActivityResource`, after generating a policy, you would need to register `Spatie\Activitylog\Models\Activity` to use that policy in the AuthServiceProvider.
+`ActivityResource` now uses strict authorization by default. If there is no registered policy, or the policy does not implement `viewAny` / `view`, the log resource is denied instead of falling back to Filament's permissive default.
+
+After generating a policy, register `Spatie\Activitylog\Models\Activity` to use that policy in the AuthServiceProvider.
 ```php
 <?php
 
@@ -77,6 +79,40 @@ class AuthServiceProvider extends ServiceProvider
 ```
 > If you are using [Shield](https://filamentphp.com/plugins/shield) just register the ActivityPolicy generated by it
 
+If you need the previous behavior for a legacy install, you can disable strict policy enforcement:
+
+```php
+'authorization' => [
+    'strict' => false,
+],
+```
+
+## Security defaults
+This package now applies a few safer defaults out of the box:
+
+- `ActivityResource` requires explicit policy methods when `authorization.strict` is enabled.
+- Sensitive keys such as passwords, tokens, secrets, and recovery codes are redacted before being stored in activity properties.
+- Access logs anonymize IP addresses and trim user agents by default.
+- Notification recipients are not logged unless `notifications.log_recipient` is explicitly enabled.
+
+Example overrides:
+
+```php
+'redacted_placeholder' => '[REDACTED]',
+
+'access' => [
+    'store_ip' => true,
+    'anonymize_ip' => true,
+    'store_user_agent' => true,
+    'user_agent_max_length' => 255,
+],
+
+'notifications' => [
+    'log_recipient' => false,
+    'mask_recipient' => true,
+],
+```
+
 ## Translations
 Publish the translations using:
 

config/filament-logger.php

@@ -2,6 +2,29 @@
 return [
     'datetime_format' => 'd/m/Y H:i:s',
     'date_format' => 'd/m/Y',
+    'redacted_placeholder' => '[REDACTED]',
+
+    'authorization' => [
+        'strict' => true,
+    ],
+
+    'sensitive_keys' => [
+        'password',
+        'password_confirmation',
+        'current_password',
+        'secret',
+        'client_secret',
+        'api_key',
+        'private_key',
+        'token',
+        'api_token',
+        'access_token',
+        'refresh_token',
+        'remember_token',
+        'two_factor_secret',
+        'two_factor_recovery_codes',
+        'recovery_codes',
+    ],
 
     'activity_resource' => \MrAdder\FilamentLogger\Resources\ActivityResource::class,
 	'scoped_to_tenant' => true,
@@ -25,13 +48,19 @@
         'logger' => \MrAdder\FilamentLogger\Loggers\AccessLogger::class,
         'color' => 'danger',
         'log_name' => 'Access',
+        'store_ip' => true,
+        'anonymize_ip' => true,
+        'store_user_agent' => true,
+        'user_agent_max_length' => 255,
     ],
 
     'notifications' => [
         'enabled' => true,
         'logger' => \MrAdder\FilamentLogger\Loggers\NotificationLogger::class,
         'color' => null,
         'log_name' => 'Notification',
+        'log_recipient' => false,
+        'mask_recipient' => true,
     ],
 
     'models' => [

src/Loggers/AbstractModelLogger.php

@@ -7,6 +7,7 @@
 use Illuminate\Contracts\Auth\Authenticatable;
 use Illuminate\Database\Eloquent\Model;
 use Illuminate\Support\Str;
+use MrAdder\FilamentLogger\Support\LogDataSanitizer;
 use Spatie\Activitylog\ActivityLogger;
 use Spatie\Activitylog\ActivityLogStatus;
 
@@ -54,7 +55,7 @@ protected function getLoggableAttributes(Model $model, mixed $values = []): arra
             $values = array_diff_key($values, array_flip($model->getHidden()));
         }
 
-        return $values;
+        return LogDataSanitizer::sanitizeProperties($values);
     }
 
     protected function log(Model $model, string $event, ?string $description = null, mixed $attributes = null)

src/Loggers/AccessLogger.php

@@ -4,6 +4,7 @@
 
 use Filament\Facades\Filament;
 use Illuminate\Auth\Events\Login;
+use MrAdder\FilamentLogger\Support\LogDataSanitizer;
 use Spatie\Activitylog\ActivityLogger;
 use Spatie\Activitylog\ActivityLogStatus;
 
@@ -18,12 +19,18 @@ class AccessLogger
     public function handle(Login $event)
     {
         $description = Filament::getUserName($event->user).' logged in';
+        $properties = LogDataSanitizer::sanitizeProperties([
+            'ip' => request()->ip(),
+            'user_agent' => request()->userAgent(),
+        ]);
+
+        $properties = array_filter($properties, fn (mixed $value): bool => filled($value));
 
         app(ActivityLogger::class)
             ->useLog(config('filament-logger.access.log_name'))
             ->setLogStatus(app(ActivityLogStatus::class))
-            ->withProperties(['ip' => request()->ip(), 'user_agent' => request()->userAgent()])
+            ->withProperties($properties)
             ->event('Login')
             ->log($description);
     }
-}
+}

src/Loggers/NotificationLogger.php

@@ -2,10 +2,9 @@
 
 namespace MrAdder\FilamentLogger\Loggers;
 
-use Illuminate\Notifications\AnonymousNotifiable;
 use Illuminate\Notifications\Events\NotificationFailed;
 use Illuminate\Notifications\Events\NotificationSent;
-use Illuminate\Notifications\Notifiable;
+use MrAdder\FilamentLogger\Support\LogDataSanitizer;
 use Illuminate\Support\Str;
 use Spatie\Activitylog\ActivityLogStatus;
 use Spatie\Activitylog\ActivityLogger;
@@ -28,10 +27,12 @@ public function handle(NotificationSent|NotificationFailed $event)
             $description = $notification.' Notification failed';
         }
 
-        $receipent = $this->getRecipient($event->notifiable, $event->channel);
-        
-        if($receipent) {
-             $description .= ' to '.$receipent;
+        $recipient = LogDataSanitizer::sanitizeNotificationRecipient(
+            $this->getRecipient($event->notifiable, $event->channel)
+        );
+
+        if ($recipient) {
+            $description .= ' to '.$recipient;
         }
 
         app(ActivityLogger::class)
@@ -45,6 +46,7 @@ public function handle(NotificationSent|NotificationFailed $event)
     public function getRecipient(mixed $notifiable, string $channel): ?string
     {
         $notificationRoute = $notifiable->routeNotificationFor($channel);
+
         return is_string($notificationRoute) ? $notificationRoute : null;
     }
 }

src/Resources/ActivityResource.php

@@ -22,6 +22,8 @@
 use Spatie\Activitylog\Contracts\Activity;
 use Spatie\Activitylog\ActivitylogServiceProvider;
 use Spatie\Activitylog\Models\Activity as ActivityModel;
+use Illuminate\Support\Facades\Gate;
+use MrAdder\FilamentLogger\Support\LogDataSanitizer;
 use MrAdder\FilamentLogger\Resources\ActivityResource\Pages;
 
 class ActivityResource extends Resource
@@ -37,6 +39,29 @@ public static function getCluster(): ?string
         return config('filament-logger.resources.cluster');
     }
 
+    public static function canAccess(): bool
+    {
+        return static::canViewAny();
+    }
+
+    public static function canViewAny(): bool
+    {
+        if (! static::hasRequiredPolicyAbility('viewAny')) {
+            return false;
+        }
+
+        return parent::canViewAny();
+    }
+
+    public static function canView(Model $record): bool
+    {
+        if (! static::hasRequiredPolicyAbility('view')) {
+            return false;
+        }
+
+        return parent::canView($record);
+    }
+
     public static function form(Form $form): Form
     {
         return $form
@@ -92,26 +117,39 @@ public static function form(Form $form): Form
                 ]),
                 Section::make()
                     ->columns()
-                    ->visible(fn ($record) => $record->properties?->count() > 0)
+                    ->visible(function (?Model $record): bool {
+                        if (! $record instanceof ActivityModel) {
+                            return false;
+                        }
+
+                        return $record->properties->count() > 0;
+                    })
                     ->schema(function (?Model $record) {
+                        if (! $record instanceof ActivityModel) {
+                            return [];
+                        }
+
                         /** @var Activity&ActivityModel $record */
-                        $properties = $record->properties->except(['attributes', 'old']);
+                        $properties = LogDataSanitizer::sanitizeProperties(
+                            $record->properties->except(['attributes', 'old'])
+                        );
 
                         $schema = [];
 
-                        if ($properties->count()) {
+                        if (count($properties) > 0) {
                             $schema[] = KeyValue::make('properties')
+                                ->afterStateHydrated(fn (KeyValue $component) => $component->state($properties))
                                 ->label(__('filament-logger::filament-logger.resource.label.properties'))
                                 ->columnSpan('full');
                         }
 
-                        if ($old = $record->properties->get('old')) {
+                        if ($old = LogDataSanitizer::sanitizeProperties($record->properties->get('old') ?? [])) {
                             $schema[] = KeyValue::make('old')
                                 ->afterStateHydrated(fn (KeyValue $component) => $component->state($old))
                                 ->label(__('filament-logger::filament-logger.resource.label.old'));
                         }
 
-                        if ($attributes = $record->properties->get('attributes')) {
+                        if ($attributes = LogDataSanitizer::sanitizeProperties($record->properties->get('attributes') ?? [])) {
                             $schema[] = KeyValue::make('attributes')
                                 ->afterStateHydrated(fn (KeyValue $component) => $component->state($attributes))
                                 ->label(__('filament-logger::filament-logger.resource.label.new'));
@@ -175,7 +213,7 @@ public static function table(Table $table): Table
 
                 Filter::make('properties->old')
 					->indicateUsing(function (array $data): ?string {
-						if (!$data['old']) {
+						if (! ($data['old'] ?? null)) {
 							return null;
 						}
 
@@ -187,7 +225,7 @@ public static function table(Table $table): Table
                             ->hint(__('filament-logger::filament-logger.resource.label.properties_hint')),
 					])
 					->query(function (Builder $query, array $data): Builder {
-						if (!$data['old']) {
+						if (! ($data['old'] ?? null)) {
 							return $query;
 						}
 
@@ -196,7 +234,7 @@ public static function table(Table $table): Table
 
 				Filter::make('properties->attributes')
 					->indicateUsing(function (array $data): ?string {
-						if (!$data['new']) {
+						if (! ($data['new'] ?? null)) {
 							return null;
 						}
 
@@ -208,7 +246,7 @@ public static function table(Table $table): Table
                             ->hint(__('filament-logger::filament-logger.resource.label.properties_hint')),
 					])
 					->query(function (Builder $query, array $data): Builder {
-						if (!$data['new']) {
+						if (! ($data['new'] ?? null)) {
 							return $query;
 						}
 
@@ -348,5 +386,14 @@ public static function getNavigationSort(): ?int
 		return config('filament-logger.navigation_sort', null);
 	}
 
-	
+    protected static function hasRequiredPolicyAbility(string $ability): bool
+    {
+        if (! config('filament-logger.authorization.strict', true)) {
+            return true;
+        }
+
+        $policy = Gate::getPolicyFor(static::getModel());
+
+        return ($policy !== null) && method_exists($policy, $ability);
+    }
 }