Migrate to encryptedPref

app/build.gradle

@@ -114,5 +114,6 @@ dependencies {
     debugImplementation 'androidx.compose.ui:ui-tooling'
     implementation 'androidx.activity:activity-compose:1.13.0'
     implementation 'androidx.activity:activity-ktx:1.13.0'
+    implementation 'androidx.security:security-crypto:1.1.0'
     implementation 'androidx.lifecycle:lifecycle-viewmodel-compose:2.11.0'
 }

app/src/main/java/net/helcel/cowspent/android/account/AccountActivity.kt

@@ -41,6 +41,7 @@ import net.helcel.cowspent.android.main.MainConstants
 import net.helcel.cowspent.theme.ThemeUtils
 import net.helcel.cowspent.util.CospendClientUtil
 import net.helcel.cowspent.util.CospendClientUtil.LoginStatus
+import net.helcel.cowspent.util.SecureStorage
 import java.net.URLDecoder
 import java.util.Locale
 
@@ -128,8 +129,6 @@ class AccountActivity : AppCompatActivity() {
                 )
             }
         }
-        
-        oldPassword = preferences.getString(SETTINGS_PASSWORD, DEFAULT_SETTINGS) ?: ""
         viewModel.validateUrl()
     }
 
@@ -310,10 +309,10 @@ class AccountActivity : AppCompatActivity() {
             }
 
             if (status == LoginStatus.OK) {
+                SecureStorage.savePassword(applicationContext, SETTINGS_PASSWORD, password)
                 preferences.edit {
                     putString(SETTINGS_URL, url)
                     putString(SETTINGS_USERNAME, username)
-                    putString(SETTINGS_PASSWORD, password)
                     remove(SETTINGS_KEY_ETAG)
                     remove(SETTINGS_KEY_LAST_MODIFIED)
                 }

app/src/main/java/net/helcel/cowspent/android/account/AccountViewModel.kt

@@ -13,6 +13,7 @@ import kotlinx.coroutines.Dispatchers
 import kotlinx.coroutines.launch
 import kotlinx.coroutines.withContext
 import net.helcel.cowspent.util.CospendClientUtil
+import net.helcel.cowspent.util.SecureStorage
 
 class AccountViewModel(application: Application) : AndroidViewModel(application) {
     private val preferences: SharedPreferences = PreferenceManager.getDefaultSharedPreferences(application)
@@ -63,7 +64,7 @@ class AccountViewModel(application: Application) : AndroidViewModel(application)
         val password = if (useSso) {
             ""
         } else {
-            preferences.getString(AccountActivity.SETTINGS_PASSWORD, "")
+            SecureStorage.getPassword(getApplication(), AccountActivity.SETTINGS_PASSWORD)
         }
 
         if (!url.isNullOrEmpty() && !username.isNullOrEmpty()) {
@@ -87,6 +88,7 @@ class AccountViewModel(application: Application) : AndroidViewModel(application)
     }
 
     fun logout() {
+        SecureStorage.removePassword(getApplication(), AccountActivity.SETTINGS_PASSWORD)
         preferences.edit {
             remove(AccountActivity.SETTINGS_USE_SSO)
             remove(AccountActivity.SETTINGS_SSO_URL)

app/src/main/java/net/helcel/cowspent/model/DBAccountProject.kt

@@ -12,6 +12,6 @@ class DBAccountProject(
 ) : Serializable {
 
     override fun toString(): String {
-        return "#DBAccountProject$id/$remoteId,$name, $ncUrl, $password, archivedTs=$archivedTs"
+        return "#DBAccountProject$id/$remoteId,$name, $ncUrl, [SECURE], archivedTs=$archivedTs"
     }
 }

app/src/main/java/net/helcel/cowspent/model/DBProject.kt

@@ -5,7 +5,7 @@ import java.io.Serializable
 class DBProject(
     var id: Long,
     var remoteId: String,
-    var password: String,
+    var password: String?,
     var name: String,
     var serverUrl: String?,
     var email: String?,

app/src/main/java/net/helcel/cowspent/persistence/CowspentSQLiteOpenHelper.kt

@@ -13,6 +13,7 @@ import androidx.preference.PreferenceManager
 import net.helcel.cowspent.R
 import net.helcel.cowspent.android.main.BillsListViewActivity
 import net.helcel.cowspent.model.*
+import net.helcel.cowspent.util.SecureStorage
 import net.helcel.cowspent.util.SupportUtil
 import java.text.SimpleDateFormat
 import java.util.*
@@ -316,11 +317,12 @@ class CowspentSQLiteOpenHelper private constructor(val context: Context) :
         val db = writableDatabase
         val values = ContentValues()
         values.put(key_remoteId, accountProject.remoteId)
-        values.put(key_password, accountProject.password)
         values.put(key_ncUrl, accountProject.ncUrl)
         values.put(key_name, accountProject.name)
         values.put(key_archived, accountProject.archivedTs ?: 0L)
-        return db.insert(table_account_projects, null, values)
+        val id = db.insert(table_account_projects, null, values)
+        SecureStorage.savePassword(context, "AccountProjectPassword_$id", accountProject.password)
+        return id
     }
 
     val accountProjects: List<DBAccountProject>
@@ -344,11 +346,13 @@ class CowspentSQLiteOpenHelper private constructor(val context: Context) :
 
     @SuppressLint("Range")
     private fun getAccountProjectFromCursor(cursor: Cursor): DBAccountProject {
+        val id = cursor.getLong(cursor.getColumnIndex(key_id))
         val archivedTs = cursor.getLong(cursor.getColumnIndex(key_archived))
+        val password = SecureStorage.getPassword(context, "AccountProjectPassword_$id")
         return DBAccountProject(
-            cursor.getLong(cursor.getColumnIndex(key_id)),
+            id,
             cursor.getString(cursor.getColumnIndex(key_remoteId)),
-            cursor.getString(cursor.getColumnIndex(key_password)),
+            password,
             cursor.getString(cursor.getColumnIndex(key_name)),
             cursor.getString(cursor.getColumnIndex(key_ncUrl)),
             if (archivedTs > 0) archivedTs else null
@@ -608,14 +612,15 @@ class CowspentSQLiteOpenHelper private constructor(val context: Context) :
         val db = writableDatabase
         val values = ContentValues()
         values.put(key_remoteId, project.remoteId)
-        values.put(key_password, project.password)
         values.put(key_bearer_token, project.bearerToken)
         values.put(key_email, project.email)
         values.put(key_name, project.name)
         values.put(key_ihmUrl, project.serverUrl)
         values.put(key_type, project.type.id)
         values.put(key_archived, project.archivedTs ?: 0L)
-        return db.insert(table_projects, null, values)
+        val id = db.insert(table_projects, null, values)
+        SecureStorage.savePassword(context, "ProjectPassword_$id", project.password)
+        return id
     }
 
     fun getProject(id: Long): DBProject? {
@@ -644,11 +649,13 @@ class CowspentSQLiteOpenHelper private constructor(val context: Context) :
 
     @SuppressLint("Range")
     private fun getProjectFromCursor(cursor: Cursor): DBProject {
+        val id = cursor.getLong(cursor.getColumnIndex(key_id))
         val archivedTs = cursor.getLong(cursor.getColumnIndex(key_archived))
+        val password = SecureStorage.getPassword(context, "ProjectPassword_$id")
         return DBProject(
-            cursor.getLong(cursor.getColumnIndex(key_id)),
+            id,
             cursor.getString(cursor.getColumnIndex(key_remoteId)),
-            cursor.getString(cursor.getColumnIndex(key_password)),
+            password,
             cursor.getString(cursor.getColumnIndex(key_name)),
             cursor.getString(cursor.getColumnIndex(key_ihmUrl)),
             cursor.getString(cursor.getColumnIndex(key_email)),
@@ -671,6 +678,7 @@ class CowspentSQLiteOpenHelper private constructor(val context: Context) :
         }
         db.delete(table_members, "$key_projectid = ?", arrayOf(id.toString()))
         db.delete(table_projects, "$key_id = ?", arrayOf(id.toString()))
+        SecureStorage.removePassword(context, "ProjectPassword_$id")
     }
 
     fun updateProject(
@@ -685,7 +693,7 @@ class CowspentSQLiteOpenHelper private constructor(val context: Context) :
         val values = ContentValues()
         if (newName != null) values.put(key_name, newName)
         if (newEmail != null) values.put(key_email, newEmail)
-        if (newPassword != null) values.put(key_password, newPassword)
+        if (newPassword != null) SecureStorage.savePassword(context, "ProjectPassword_$projId", newPassword)
         if (newBearerToken != null) values.put(key_bearer_token, newBearerToken)
         if (newLastPayerId != null) values.put(key_lastPayerId, newLastPayerId)
         if (newLastSyncedTimestamp != null) values.put(key_lastSyncTimestamp, newLastSyncedTimestamp)
@@ -725,7 +733,7 @@ class CowspentSQLiteOpenHelper private constructor(val context: Context) :
         val values = ContentValues()
         if (newName != null) values.put(key_name, newName)
         if (newEmail != null) values.put(key_email, newEmail)
-        if (newPassword != null) values.put(key_password, newPassword)
+        if (newPassword != null) SecureStorage.savePassword(context, "ProjectPassword_$projId", newPassword)
         if (newBearerToken != null) values.put(key_bearer_token, newBearerToken)
         if (newLastPayerId != null) values.put(key_lastPayerId, newLastPayerId)
         if (newLastSyncedTimestamp != null) values.put(key_lastSyncTimestamp, newLastSyncedTimestamp)

app/src/main/java/net/helcel/cowspent/util/NextcloudClient.kt

@@ -35,13 +35,13 @@ class NextcloudClient(
         val method = if (useOcsApi) METHOD_GET else METHOD_POST
         return if (nextcloudAPI != null) {
             Log.d(javaClass.simpleName, "using SSO to get/sync account projects")
-            Log.d(javaClass.simpleName, "Sync projects target $target")
+//            Log.d(javaClass.simpleName, "Sync projects target $target")
             ServerResponse.AccountProjectsResponse(
                 requestServerWithSSO(nextcloudAPI, target, method, null, useOcsApi),
                 useOcsApi
             )
         } else {
-            Log.d(javaClass.simpleName, "Sync projects target $target")
+//            Log.d(javaClass.simpleName, "Sync projects target $target")
             ServerResponse.AccountProjectsResponse(
                 requestServer(target, method, null, "", true, useOcsApi),
                 useOcsApi
@@ -184,7 +184,7 @@ class NextcloudClient(
     ): VersatileProjectSyncClient.ResponseData {
         val result = StringBuilder()
         val targetURL = url + target.replace("^/".toRegex(), "")
-        Log.d(javaClass.simpleName, "method and target URL: $method $targetURL")
+//        Log.d(javaClass.simpleName, "method and target URL: $method $targetURL")
         val httpCon = SupportUtil.getHttpURLConnection(targetURL)
         httpCon.requestMethod = method
         if (needLogin) {
@@ -206,7 +206,7 @@ class NextcloudClient(
         var paramData: ByteArray? = null
         if (params != null) {
             paramData = params.toString().toByteArray()
-            Log.d(javaClass.simpleName, "Params: $params")
+//            Log.d(javaClass.simpleName, "Params: $params")
             httpCon.setFixedLengthStreamingMode(paramData.size)
             httpCon.setRequestProperty("Content-Type", application_json)
             httpCon.doOutput = true
@@ -263,11 +263,11 @@ class NextcloudClient(
             httpCon.setRequestProperty("OCS-APIRequest", "true")
         }
         httpCon.connectTimeout = 10 * 1000 // 10 seconds
-        Log.d(javaClass.simpleName, "$method $targetURL")
+//        Log.d(javaClass.simpleName, "$method $targetURL")
         var paramData: ByteArray?
         if (params != null) {
             paramData = params.toString().toByteArray()
-            Log.d(javaClass.simpleName, "Params: $params")
+//            Log.d(javaClass.simpleName, "Params: $params")
             httpCon.setFixedLengthStreamingMode(paramData.size)
             httpCon.setRequestProperty("Content-Type", application_json)
             httpCon.doOutput = true

app/src/main/java/net/helcel/cowspent/util/SecureStorage.kt

@@ -0,0 +1,47 @@
+package net.helcel.cowspent.util
+
+import android.content.Context
+import android.content.SharedPreferences
+import androidx.security.crypto.EncryptedSharedPreferences
+import androidx.security.crypto.MasterKey
+import androidx.core.content.edit
+
+object SecureStorage {
+    private const val SECURE_PREFS_NAME = "secure_prefs"
+    private var encryptedPrefs: SharedPreferences? = null
+
+    @Synchronized
+    fun getEncryptedPrefs(context: Context): SharedPreferences {
+        encryptedPrefs?.let { return it }
+        
+        val masterKey = MasterKey.Builder(context)
+            .setKeyScheme(MasterKey.KeyScheme.AES256_GCM)
+            .build()
+            
+        val prefs = EncryptedSharedPreferences.create(
+            context,
+            SECURE_PREFS_NAME,
+            masterKey,
+            EncryptedSharedPreferences.PrefKeyEncryptionScheme.AES256_SIV,
+            EncryptedSharedPreferences.PrefValueEncryptionScheme.AES256_GCM
+        )
+        encryptedPrefs = prefs
+        return prefs
+    }
+
+    fun savePassword(context: Context, key: String, password: String?) {
+        if (password == null) {
+            removePassword(context, key)
+        } else {
+            getEncryptedPrefs(context).edit { putString(key, password) }
+        }
+    }
+
+    fun getPassword(context: Context, key: String): String? {
+        return getEncryptedPrefs(context).getString(key, null)
+    }
+
+    fun removePassword(context: Context, key: String) {
+        getEncryptedPrefs(context).edit { remove(key) }
+    }
+}

app/src/main/java/net/helcel/cowspent/util/VersatileProjectSyncClient.kt

@@ -81,13 +81,9 @@ class VersatileProjectSyncClient(
                 else
                     project.getRequestBaseUrl(false) + "/api-priv/projects/" + project.remoteId
                 useOcsApiRequest = cospendVersionGT161
-                if (cospendVersionGT161) {
-                    Log.i(TAG, "using new API (weblogin, $username:$password) for getProjectInfo")
-                }
             } else if (canAccessProjectWithSSO(project)) {
                 return if (cospendVersionGT161) {
                     target = "/ocs/v2.php/apps/cospend/api/v1/projects/" + project.remoteId
-                    Log.i(TAG, "using new API for getProjectInfo")
                     ServerResponse.ProjectResponse(requestServerWithSSO(nextcloudAPI!!, target, METHOD_GET, null, null, true), true)
                 } else {
                     target = "/index.php/apps/cospend/api-priv/projects/" + project.remoteId
@@ -99,7 +95,6 @@ class VersatileProjectSyncClient(
                     project.getRequestBaseUrl(true) + "/api/v1/public/projects/" + project.remoteId + "/" + getEncodedPassword(project.password)
                 else
                     project.getRequestBaseUrl(false) + "/api/projects/" + project.remoteId + "/" + getEncodedPassword(project.password)
-                Log.i(TAG, "using public API, target is: ${target}for getProjectInfo")
             }
         } else {
             target = project.serverUrl!!.replace("/+$".toRegex(), "") + "/api/projects/" + project.remoteId
@@ -172,13 +167,9 @@ class VersatileProjectSyncClient(
                 else
                     project.getRequestBaseUrl(false) + "/api-priv/projects/" + project.remoteId
                 useOcsApiRequest = cospendVersionGT161
-                if (cospendVersionGT161) {
-                    Log.i(TAG, "using new API (weblogin, $username:$password) for editRemoteProject")
-                }
             } else if (canAccessProjectWithSSO(project)) {
                 return if (cospendVersionGT161) {
                     target = "/ocs/v2.php/apps/cospend/api/v1/projects/" + project.remoteId
-                    Log.i(TAG, "using new API for editRemoteProject")
                     ServerResponse.EditRemoteProjectResponse(requestServerWithSSO(nextcloudAPI!!, target, METHOD_PUT, paramKeys, paramValues, true), true)
                 } else {
                     target = "/index.php/apps/cospend/api-priv/projects/" + project.remoteId
@@ -190,7 +181,6 @@ class VersatileProjectSyncClient(
                     project.getRequestBaseUrl(true) + "/api/v1/public/projects/" + project.remoteId + "/" + getEncodedPassword(project.password)
                 else
                     project.getRequestBaseUrl(false) + "/api/projects/" + project.remoteId + "/" + getEncodedPassword(project.password)
-                Log.i(TAG, "using public API, target is: ${target}for editRemoteProject")
             }
         } else {
             target = project.serverUrl!!.replace("/+$".toRegex(), "") + "/api/projects/" + project.remoteId
@@ -239,13 +229,9 @@ class VersatileProjectSyncClient(
                 else
                     project.getRequestBaseUrl(false) + "/api-priv/projects/" + project.remoteId + "/members/" + member.remoteId
                 useOcsApiRequest = cospendVersionGT161
-                if (cospendVersionGT161) {
-                    Log.i(TAG, "using new API (weblogin, $username:$password) for editRemoteMember")
-                }
             } else if (canAccessProjectWithSSO(project)) {
                 return if (cospendVersionGT161) {
                     target = "/ocs/v2.php/apps/cospend/api/v1/projects/" + project.remoteId + "/members/" + member.remoteId
-                    Log.i(TAG, "using new API for editRemoteMember")
                     ServerResponse.EditRemoteMemberResponse(requestServerWithSSO(nextcloudAPI!!, target, METHOD_PUT, paramKeys, paramValues, true), true)
                 } else {
                     target = "/index.php/apps/cospend/api-priv/projects/" + project.remoteId + "/members/" + member.remoteId
@@ -257,7 +243,6 @@ class VersatileProjectSyncClient(
                     project.getRequestBaseUrl(true) + "/api/v1/public/projects/" + project.remoteId + "/" + getEncodedPassword(project.password) + "/members/" + member.remoteId
                 else
                     project.getRequestBaseUrl(false) + "/api/projects/" + project.remoteId + "/" + getEncodedPassword(project.password) + "/members/" + member.remoteId
-                Log.i(TAG, "using public API, target is: ${target}for editRemoteMember")
             }
         } else {
             target = project.serverUrl!!.replace("/+$".toRegex(), "") + "/api/projects/" + project.remoteId + "/members/" + member.remoteId
@@ -333,9 +318,6 @@ class VersatileProjectSyncClient(
                 else
                     project.getRequestBaseUrl(false) + "/api-priv/projects/" + project.remoteId + "/bills/" + bill.remoteId
                 useOcsApiRequest = cospendVersionGT161
-                if (cospendVersionGT161) {
-                    Log.i(TAG, "using new API (weblogin, $username:$password) for editRemoteBill")
-                }
             } else if (canAccessProjectWithSSO(project)) {
                 return if (cospendVersionGT161) {
                     target = "/ocs/v2.php/apps/cospend/api/v1/projects/" + project.remoteId + "/bills/" + bill.remoteId
@@ -351,7 +333,7 @@ class VersatileProjectSyncClient(
                     project.getRequestBaseUrl(true) + "/api/v1/public/projects/" + project.remoteId + "/" + getEncodedPassword(project.password) + "/bills/" + bill.remoteId
                 else
                     project.getRequestBaseUrl(false) + "/api/projects/" + project.remoteId + "/" + getEncodedPassword(project.password) + "/bills/" + bill.remoteId
-                Log.i(TAG, "using public API, target is: ${target}for editRemoteBill")
+                Log.i(TAG, "using public API, target is: ${SupportUtil.maskUrl(target)} for editRemoteBill")
             }
         } else {
             target = project.serverUrl!!.replace("/+$".toRegex(), "") + "/api/projects/" + project.remoteId + "/bills/" + bill.remoteId
@@ -389,9 +371,6 @@ class VersatileProjectSyncClient(
                 else
                     project.getRequestBaseUrl(false) + "/api-priv/projects/" + project.remoteId
                 useOcsApiRequest = cospendVersionGT161
-                if (cospendVersionGT161) {
-                    Log.i(TAG, "using new API (weblogin, $username:$password) for deleteRemoteProject")
-                }
             } else if (canAccessProjectWithSSO(project)) {
                 return if (cospendVersionGT161) {
                     target = "/ocs/v2.php/apps/cospend/api/v1/projects/" + project.remoteId
@@ -407,7 +386,7 @@ class VersatileProjectSyncClient(
                     project.getRequestBaseUrl(true) + "/api/v1/public/projects/" + project.remoteId + "/" + getEncodedPassword(project.password)
                 else
                     project.getRequestBaseUrl(false) + "/api/projects/" + project.remoteId + "/" + getEncodedPassword(project.password)
-                Log.i(TAG, "using public API, target is: ${target}for deleteRemoteProject")
+                Log.i(TAG, "using public API, target is: ${SupportUtil.maskUrl(target)} for deleteRemoteProject")
             }
         } else {
             target = project.serverUrl!!.replace("/+$".toRegex(), "") + "/api/projects/" + project.remoteId
@@ -439,9 +418,6 @@ class VersatileProjectSyncClient(
                 else
                     project.getRequestBaseUrl(false) + "/api-priv/projects/" + project.remoteId + "/bills/" + billRemoteId
                 useOcsApiRequest = cospendVersionGT161
-                if (cospendVersionGT161) {
-                    Log.i(TAG, "using new API (weblogin, $username:$password) for deleteRemoteBill")
-                }
             } else if (canAccessProjectWithSSO(project)) {
                 return if (cospendVersionGT161) {
                     target = "/ocs/v2.php/apps/cospend/api/v1/projects/" + project.remoteId + "/bills/" + billRemoteId
@@ -457,7 +433,7 @@ class VersatileProjectSyncClient(
                     project.getRequestBaseUrl(true) + "/api/v1/public/projects/" + project.remoteId + "/" + getEncodedPassword(project.password) + "/bills/" + billRemoteId
                 else
                     project.getRequestBaseUrl(false) + "/api/projects/" + project.remoteId + "/" + getEncodedPassword(project.password) + "/bills/" + billRemoteId
-                Log.i(TAG, "using public API, target is: ${target}for deleteRemoteProject")
+                Log.i(TAG, "using public API, target is: ${SupportUtil.maskUrl(target)} for deleteRemoteProject")
             }
         } else {
             target = project.serverUrl!!.replace("/+$".toRegex(), "") + "/api/projects/" + project.remoteId + "/bills/" + billRemoteId
@@ -529,8 +505,7 @@ class VersatileProjectSyncClient(
                 project.getRequestBaseUrl(false) + "/api-priv/projects"
             useOcsApiRequest = cospendVersionGT161
             if (cospendVersionGT161) {
-                Log.i(TAG, "using new API (weblogin, $username:$password) for createAuthenticatedRemoteProject")
+                    }
-            }
             return ServerResponse.CreateRemoteProjectResponse(
                 requestServer(
                     target, METHOD_POST, paramKeys, paramValues,
@@ -594,9 +569,6 @@ class VersatileProjectSyncClient(
                 else
                     project.getRequestBaseUrl(false) + "/api-priv/projects/" + project.remoteId + "/bills"
                 useOcsApiRequest = cospendVersionGT161
-                if (cospendVersionGT161) {
-                    Log.i(TAG, "using new API (weblogin, $username:$password) for createRemoteBill")
-                }
             } else if (canAccessProjectWithSSO(project)) {
                 return if (cospendVersionGT161) {
                     target = "/ocs/v2.php/apps/cospend/api/v1/projects/" + project.remoteId + "/bills"
@@ -612,7 +584,7 @@ class VersatileProjectSyncClient(
                     project.getRequestBaseUrl(true) + "/api/v1/public/projects/" + project.remoteId + "/" + getEncodedPassword(project.password) + "/bills"
                 else
                     project.getRequestBaseUrl(false) + "/api/projects/" + project.remoteId + "/" + getEncodedPassword(project.password) + "/bills"
-                Log.i(TAG, "using public API, target is: ${target}for createRemoteBill")
+                Log.i(TAG, "using public API, target is: ${SupportUtil.maskUrl(target)} for createRemoteBill")
             }
         } else {
             target = project.serverUrl!!.replace("/+$".toRegex(), "") + "/api/projects/" + project.remoteId + "/bills"
@@ -664,9 +636,6 @@ class VersatileProjectSyncClient(
                 else
                     project.getRequestBaseUrl(false) + "/api-priv/projects/" + project.remoteId + "/members"
                 useOcsApiRequest = cospendVersionGT161
-                if (cospendVersionGT161) {
-                    Log.i(TAG, "using new API (weblogin, $username:$password) for createRemoteMember")
-                }
             } else if (canAccessProjectWithSSO(project)) {
                 return if (cospendVersionGT161) {
                     target = "/ocs/v2.php/apps/cospend/api/v1/projects/" + project.remoteId + "/members"
@@ -682,7 +651,7 @@ class VersatileProjectSyncClient(
                     project.getRequestBaseUrl(true) + "/api/v1/public/projects/" + project.remoteId + "/" + getEncodedPassword(project.password) + "/members"
                 else
                     project.getRequestBaseUrl(false) + "/api/projects/" + project.remoteId + "/" + getEncodedPassword(project.password) + "/members"
-                Log.i(TAG, "using public API, target is: ${target}for createRemoteBill")
+                Log.i(TAG, "using public API, target is: ${SupportUtil.maskUrl(target)} for createRemoteBill")
             }
         } else {
             target = project.serverUrl!!.replace("/+$".toRegex(), "") + "/api/projects/" + project.remoteId + "/members"
@@ -718,8 +687,7 @@ class VersatileProjectSyncClient(
                     project.getRequestBaseUrl(false) + "/api-priv/projects/" + project.remoteId + "/bills?lastchanged=" + tsLastSync
                 useOcsApiRequest = cospendVersionGT161
                 if (cospendVersionGT161) {
-                    Log.i(TAG, "using new API (weblogin, $username:$password) for getBills")
+                            }
-                }
                 return ServerResponse.BillsResponse(
                     requestServer(
                         target, METHOD_GET, null, null,
@@ -750,7 +718,7 @@ class VersatileProjectSyncClient(
                     project.getRequestBaseUrl(true) + "/api/v1/public/projects/" + project.remoteId + "/" + getEncodedPassword(project.password) + "/bills?lastChanged=" + tsLastSync
                 else
                     project.getRequestBaseUrl(false) + "/apiv2/projects/" + project.remoteId + "/" + getEncodedPassword(project.password) + "/bills?lastchanged=" + tsLastSync
-                Log.i(TAG, "using public API, target is: ${target}for getBills")
+                Log.i(TAG, "using public API, target is: ${SupportUtil.maskUrl(target)} for getBills")
                 return ServerResponse.BillsResponse(
                     requestServer(
                          target, METHOD_GET, null, null,
@@ -790,9 +758,6 @@ class VersatileProjectSyncClient(
                 else
                     project.getRequestBaseUrl(false) + "/api-priv/projects/" + project.remoteId + "/members"
                 useOcsApiRequest = cospendVersionGT161
-                if (cospendVersionGT161) {
-                    Log.i(TAG, "using new API (weblogin, $username:$password) for getMembers, projectId: " + project.remoteId)
-                }
             } else if (canAccessProjectWithSSO(project)) {
                 return if (cospendVersionGT161) {
                     target = "/ocs/v2.php/apps/cospend/api/v1/projects/" + project.remoteId + "/members"
@@ -808,7 +773,7 @@ class VersatileProjectSyncClient(
                     project.getRequestBaseUrl(true) + "/api/v1/public/projects/" + project.remoteId + "/" + getEncodedPassword(project.password) + "/members"
                 else
                     project.getRequestBaseUrl(false) + "/api/projects/" + project.remoteId + "/" + getEncodedPassword(project.password) + "/members"
-                Log.i(TAG, "using public API, target is: ${target}for getMembers")
+                Log.i(TAG, "using public API, target is: ${SupportUtil.maskUrl(target)} for getMembers")
             }
         } else {
             target = project.serverUrl!!.replace("/+$".toRegex(), "") + "/api/projects/" + project.remoteId + "/members"
@@ -847,9 +812,6 @@ class VersatileProjectSyncClient(
                 else
                     project.getRequestBaseUrl(false) + "/api-priv/projects/" + project.remoteId + "/currency"
                 useOcsApiRequest = cospendVersionGT161
-                if (cospendVersionGT161) {
-                    Log.i(TAG, "using new API (weblogin, $username:$password) for createRemoteCurrency")
-                }
             } else if (canAccessProjectWithSSO(project)) {
                 return if (cospendVersionGT161) {
                     target = "/ocs/v2.php/apps/cospend/api/v1/projects/" + project.remoteId + "/currency"
@@ -865,7 +827,7 @@ class VersatileProjectSyncClient(
                     project.getRequestBaseUrl(true) + "/api/v1/public/projects/" + project.remoteId + "/" + getEncodedPassword(project.password) + "/currency"
                 else
                     project.getRequestBaseUrl(false) + "/api/projects/" + project.remoteId + "/" + getEncodedPassword(project.password) + "/currency"
-                Log.i(TAG, "using public API, target is: ${target}for createRemoteCurrency")
+                Log.i(TAG, "using public API, target is: ${SupportUtil.maskUrl(target)} for createRemoteCurrency")
             }
         } else {
             target = project.serverUrl!!.replace("/+$".toRegex(), "") + "/api/projects/" + project.remoteId + "/currency"
@@ -904,9 +866,6 @@ class VersatileProjectSyncClient(
                 else
                     project.getRequestBaseUrl(false) + "/api-priv/projects/" + project.remoteId + "/currency/" + currency.remoteId
                 useOcsApiRequest = cospendVersionGT161
-                if (cospendVersionGT161) {
-                    Log.i(TAG, "using new API (weblogin, $username:$password) for editRemoteCurrency")
-                }
             } else if (canAccessProjectWithSSO(project)) {
                 return if (cospendVersionGT161) {
                     target = "/ocs/v2.php/apps/cospend/api/v1/projects/" + project.remoteId + "/currency/" + currency.remoteId
@@ -922,7 +881,7 @@ class VersatileProjectSyncClient(
                     project.getRequestBaseUrl(true) + "/api/v1/public/projects/" + project.remoteId + "/" + getEncodedPassword(project.password) + "/currency/" + currency.remoteId
                 else
                     project.getRequestBaseUrl(false) + "/api/projects/" + project.remoteId + "/" + getEncodedPassword(project.password) + "/currency/" + currency.remoteId
-                Log.i(TAG, "using public API, target is: ${target}for createRemoteCurrency")
+                Log.i(TAG, "using public API, target is: ${SupportUtil.maskUrl(target)} for createRemoteCurrency")
             }
         } else {
             target = project.serverUrl!!.replace("/+$".toRegex(), "") + "/api/projects/" + project.remoteId + "/currency/" + currency.remoteId
@@ -954,9 +913,6 @@ class VersatileProjectSyncClient(
                 else
                     project.getRequestBaseUrl(false) + "/api-priv/projects/" + project.remoteId + "/currency/" + currencyRemoteId
                 useOcsApiRequest = cospendVersionGT161
-                if (cospendVersionGT161) {
-                    Log.i(TAG, "using new API (weblogin, $username:$password) for deleteRemoteCurrency")
-                }
             } else if (canAccessProjectWithSSO(project)) {
                 return if (cospendVersionGT161) {
                     target = "/ocs/v2.php/apps/cospend/api/v1/projects/" + project.remoteId + "/currency/" + currencyRemoteId
@@ -972,7 +928,7 @@ class VersatileProjectSyncClient(
                     project.getRequestBaseUrl(true) + "/api/v1/public/projects/" + project.remoteId + "/" + getEncodedPassword(project.password) + "/currency/" + currencyRemoteId
                 else
                     project.getRequestBaseUrl(false) + "/api/projects/" + project.remoteId + "/" + getEncodedPassword(project.password) + "/currency/" + currencyRemoteId
-                Log.i(TAG, "using public API, target is: ${target}for deleteRemoteCurrency")
+                Log.i(TAG, "using public API, target is: ${SupportUtil.maskUrl(target)} for deleteRemoteCurrency")
             }
         } else {
             target = project.serverUrl!!.replace("/+$".toRegex(), "") + "/api/projects/" + project.remoteId + "/currency/" + currencyRemoteId
@@ -1071,7 +1027,7 @@ class VersatileProjectSyncClient(
             httpCon.setRequestProperty("Accept", "application/json")
         }
         httpCon.connectTimeout = 10 * 1000 // 10 seconds
-        Log.d(javaClass.simpleName, "$method $target")
+        Log.d(javaClass.simpleName, "$method ${SupportUtil.maskUrl(target)}")
         if (paramKeys != null && paramValues != null) {
             var dataString = ""
             for (i in paramKeys.indices) {
@@ -1084,7 +1040,7 @@ class VersatileProjectSyncClient(
                 dataString += URLEncoder.encode(value, "UTF-8")
             }
             val data = dataString.toByteArray()
-            Log.d(javaClass.simpleName, "Params: $dataString")
+            Log.d(javaClass.simpleName, "Params: ${SupportUtil.maskParams(dataString)}")
             httpCon.setFixedLengthStreamingMode(data.size)
             httpCon.setRequestProperty("Content-Type", "application/x-www-form-urlencoded")
             httpCon.setRequestProperty("Content-Length", data.size.toString())