Hiding Properties without Values

[codesynergy]

Hello,

I have some properties that contain sensitive information, and I want to hide them from the log file. From what I understand, I can do via the "Hide Property" option. The problem is, if I leave the "value" field blank, the property will not be hidden in the log. If I do specify a value (even if it's just a space character), it will be hidden in the log file. This post suggests that, as long as you have a value for the "comments" field, then the "value" field can be blank, and the property will still be hidden in the log file. However, this does not seem to be the case. The attached test project can be used to reproduce the issue. For some properties, I don't want a default value.

So, my questions are:

• Should a property with the "Hide Property" option selected be hidden from the log file if has doesn't have a value, but it does have a comment?

• If not, what's the best way around this? It sounds like I can add the "MsiHiddenProperties" property to my project and add any properties I want to hide to it. But, does that mean if I use the "Hide Property" option as described above (or using the "password" attribute on an edit control) it will overwrite what I set in MsiHiddenProperties? Or, will it add to it?

Thanks!

[Catalin]

Hello,

It sounds like I can add the "MsiHiddenProperties" property to my project and add any properties I want to hide to it

When using the "Hide property" attribute for one of your properties, this is exactly what happens. You can see this by searching for your property in the log file:

MyProp.png (12.01 KiB) Viewed 8630 times

MyPropLogFile.png (126.39 KiB) Viewed 8630 times

In addition to this, I have also tested the scenario where the property is empty with a comment. From what I could see, the property is only specified when it is added to the MsiHiddenProperties property, just as when it has a value.

Hope this helps.

Best regards,
Catalin

[codesynergy]

Hi Catalin,

In the attached project, using the command in the comment, I do not see "MsiHiddenProperties" in the log, and the password for the hidden property is displayed:

PasswordDisplayed.PNG (120.11 KiB) Viewed 8603 times

I'm using Advanced Installer 16.7... not sure if that matters?


Thanks!

[Catalin]

Hello,

Thank you for your followup on this.

I have further tested this and I was able to replicate the behavior.

Unfortunately, I can not say for sure why this happens.

I have forwarded this to our development team for further research.

In the meantime, you can avoid this by:

1. setting a default value for your property

2. setting the "Password" attribute for your property

Hope this helps.

Best regards,
Catalin

[codesynergy]

In the meantime, you can avoid this by:

1. setting a default value for your property

2. setting the "Password" attribute for your property

For a lot of properties, we don't want a default value, as that could signify something (i.e., the user passed in a value). Though, an empty space could work, but our custom code would need to account for that.
By "Password" attribute, do you mean for an edit control? A lot of our properties aren't associated with an edit control. And, some that are tied to an edit control shouldn't be hidden (astriks) when the user types it in.

The workaround I went with:
Create "MsiHiddenProperties" in the table editor and add all our sensitive properties and deferred/commit custom action names (to handle properties passed in to the custom action). However, there appears to be a character limit (256?) that Advanced Installer implements. So, I had to set MsiHiddenProperties in a text editor. I recommend the character limit be increased if the restriction is on AI's side of things (windows installer/MSI seems to handle it fine).

There is a potential issue here if AI were to over-write/re-define MsiHiddenProperties. But, that doesn't seem to be an issue with our project right now, so this is the workaround I'm going with for now.

Also, how does AI handle hiding custom action data? Even if a property is in MsiHiddenProperties, it will be displayed if you pass it into a custom action. I had to add the custom action name to MsiHiddenProperties also. Does AI provide an easy way to do this?


Thanks!

[Catalin]

Hello,

By "Password" attribute, do you mean for an edit control?

Yes, that is what I mean.

A lot of our properties aren't associated with an edit control. And, some that are tied to an edit control shouldn't be hidden (astriks) when the user types it in.

I see. I thought that you guys may need to only hide some properties that should store passwords.

The workaround I went with:
Create "MsiHiddenProperties" in the table editor and add all our sensitive properties and deferred/commit custom action names (to handle properties passed in to the custom action). However, there appears to be a character limit (256?) that Advanced Installer implements. So, I had to set MsiHiddenProperties in a text editor. I recommend the character limit be increased if the restriction is on AI's side of things (windows installer/MSI seems to handle it fine).

I am really glad you got this working.

Honestly, it is quite strange to me that this workaround is working. As I have explained earlier, when the "Hide property" flag is used for one of your proerties, we do the exact same thing - e.g. add the property name to "MsiHiddentProperties". It looks, however, that we do this at install time instead of build time.

In what regards the character limit, from I know, there should be none.

Could you please give me some more details about this? Did you add the "MsiHiddenProperties" property in the "Property" table and you have added multiple properties that in total exceeds 256 characters and it did not work?

I had to add the custom action name to MsiHiddenProperties also.

If the content of a property is assigned to another property, its' content will be visible in the log. The way you approached this is indeed the correct way.

Best regards,
Catalin

[codesynergy]

The workaround I went with:
Create "MsiHiddenProperties" in the table editor and add all our sensitive properties and deferred/commit custom action names (to handle properties passed in to the custom action). However, there appears to be a character limit (256?) that Advanced Installer implements. So, I had to set MsiHiddenProperties in a text editor. I recommend the character limit be increased if the restriction is on AI's side of things (windows installer/MSI seems to handle it fine).

I am really glad you got this working.

Honestly, it is quite strange to me that this workaround is working. As I have explained earlier, when the "Hide property" flag is used for one of your proerties, we do the exact same thing - e.g. add the property name to "MsiHiddentProperties". It looks, however, that we do this at install time instead of build time.

In my testing, setting the "Hide Property" option will add the property to the MSI (MsiHiddenProperties") at build time. And, the god news is, it appears to append the property, instead of overwriting it. So, it appears this setting is mostly working the way it should, except when the value of the property is empty.

In what regards the character limit, from I know, there should be none.

Could you please give me some more details about this? Did you add the "MsiHiddenProperties" property in the "Property" table and you have added multiple properties that in total exceeds 256 characters and it did not work?

That is correct. When editing MsiHiddenProperties in the table editor of AI, the "value" field seems to have a character limit (appears it might be 256). However, after the MSI is built, I can open it in Orca and paste in a longer string.

I had to add the custom action name to MsiHiddenProperties also.

If the content of a property is assigned to another property, its' content will be visible in the log. The way you approached this is indeed the correct way.

Since you have the "Hide Property" option for individual properties, I think it would be nice to have a similar option for deferred/commit custom actions. Another checkbox that would add the custom action name to MsiHiddenProperties? Something like that.


Thanks!

[Catalin]

Hello,

In my testing, setting the "Hide Property" option will add the property to the MSI (MsiHiddenProperties") at build time. And, the god news is, it appears to append the property, instead of overwriting it. So, it appears this setting is mostly working the way it should, except when the value of the property is empty.

This is indeed good news. As I have mentioned earlier, I have already forwarded the presented scenario to the development team so we can improve it in the future.

In what regards the fact that the property is added at build time, I believe this might be related to this:

Note that you cannot use the Property table to set a property to the value of another property. The installer does nothing to the text string entered in the Value column before setting the property in the Property column. If FirstProperty is entered into the Property column and [SecondProperty] in the Value column, the value of FirstProperty is set to the text string "[SecondProperty]" and not to the value of the SecondProperty property.

Source: Property Table

That is correct. When editing MsiHiddenProperties in the table editor of AI, the "value" field seems to have a character limit (appears it might be 256). However, after the MSI is built, I can open it in Orca and paste in a longer string.

I have tested this and you are indeed right. It looks like I can only input a maximum of 255 characters in the "Value" field of the property.

I will further discuss this with the developer in charge and I will let you know the conclusion of our discussion.

Since you have the "Hide Property" option for individual properties, I think it would be nice to have a similar option for deferred/commit custom actions. Another checkbox that would add the custom action name to MsiHiddenProperties? Something like that.

This looks like a nice improvement, indeed. I will add this on our TODO list of improvements. Thank you for bringing this to our attention.

Best regards,
Catalin

[Catalin]

Hello,

As a followup to my latest thread:

I have further discussed with our developer about the characters limit in the Table Editor.

I have added a new task on our TODO list to remove this limitation.

Best regards,
Catalin

[Catalin]

Hello,

This improvement has been added in Advanced Installer 17.3, released on July 29th, 2020.


Best regards,
Catalin

[Catalin]

Hello,

This improvement ("Hide property attribute is ignored for an empty property assigned to a UI control") has been added in Advanced Installer 17.4, released on August 26th, 2020.

The other improvement was about the 255 characters limit.

Best regards,
Catalin