#152 #147 introduce a setVerbose() toggle to prevent debug info leaking

in production
apereo · Aug 29, 2015 · 18baccf · 18baccf
1 parent 46d90eb
commit 18baccf
Show file tree

Hide file tree

Showing 22 changed files with 95 additions and 7 deletions.
diff --git a/docs/examples/example_advanced_saml11.php b/docs/examples/example_advanced_saml11.php
@@ -21,6 +21,8 @@
 
 // Enable debugging
 phpCAS::setDebug();
+// Enable verbose error messages. Disable in production!
+phpCAS::setVerbose(true);
 
 // Initialize phpCAS
 phpCAS::client(SAML_VERSION_1_1, $cas_host, $cas_port, $cas_context);

diff --git a/docs/examples/example_custom_urls.php b/docs/examples/example_custom_urls.php
@@ -21,6 +21,8 @@
 
 // Enable debugging
 phpCAS::setDebug();
+// Enable verbose error messages. Disable in production!
+phpCAS::setVerbose(true);
 
 // Initialize phpCAS
 phpCAS::client(CAS_VERSION_2_0, $cas_host, $cas_port, $cas_context);

diff --git a/docs/examples/example_gateway.php b/docs/examples/example_gateway.php
@@ -21,6 +21,8 @@
 
 // Enable debugging
 phpCAS::setDebug();
+// Enable verbose error messages. Disable in production!
+phpCAS::setVerbose(true);
 
 // Initialize phpCAS
 phpCAS::client(CAS_VERSION_2_0, $cas_host, $cas_port, $cas_context);

diff --git a/docs/examples/example_hardening.php b/docs/examples/example_hardening.php
@@ -21,6 +21,8 @@
 
 // Enable debugging
 phpCAS::setDebug();
+// Enable verbose error messages. Disable in production!
+phpCAS::setVerbose(false);
 
 // Harden session cookie to prevent some attacks on the cookie (e.g. XSS)
 session_set_cookie_params($client_lifetime, $client_path, $client_domain, $client_secure, $client_httpOnly);

diff --git a/docs/examples/example_html.php b/docs/examples/example_html.php
@@ -21,6 +21,8 @@
 
 // Enable debugging
 phpCAS::setDebug();
+// Enable verbose error messages. Disable in production!
+phpCAS::setVerbose(true);
 
 // Initialize phpCAS
 phpCAS::client(CAS_VERSION_2_0, $cas_host, $cas_port, $cas_context);

diff --git a/docs/examples/example_lang.php b/docs/examples/example_lang.php
@@ -21,6 +21,8 @@
 
 // Enable debugging
 phpCAS::setDebug();
+// Enable verbose error messages. Disable in production!
+phpCAS::setVerbose(true);
 
 // Initialize phpCAS
 phpCAS::client(CAS_VERSION_2_0, $cas_host, $cas_port, $cas_context);

diff --git a/docs/examples/example_logout.php b/docs/examples/example_logout.php
@@ -21,6 +21,8 @@
 
 // Enable debugging
 phpCAS::setDebug();
+// Enable verbose error messages. Disable in production!
+phpCAS::setVerbose(true);
 
 // Initialize phpCAS
 phpCAS::client(CAS_VERSION_2_0, $cas_host, $cas_port, $cas_context);

diff --git a/docs/examples/example_no_ssl_cn_validation.php b/docs/examples/example_no_ssl_cn_validation.php
@@ -21,6 +21,8 @@
 
 // Enable debugging
 phpCAS::setDebug();
+// Enable verbose error messages. Disable in production!
+phpCAS::setVerbose(true);
 
 // Initialize phpCAS
 phpCAS::client(CAS_VERSION_2_0, $cas_host, $cas_port, $cas_context);

diff --git a/docs/examples/example_pgt_storage_db.php b/docs/examples/example_pgt_storage_db.php
@@ -21,6 +21,8 @@
 
 // Enable debugging
 phpCAS::setDebug();
+// Enable verbose error messages. Disable in production!
+phpCAS::setVerbose(true);
 
 // Initialize phpCAS
 phpCAS::proxy(CAS_VERSION_2_0, $cas_host, $cas_port, $cas_context);

diff --git a/docs/examples/example_pgt_storage_file.php b/docs/examples/example_pgt_storage_file.php
@@ -21,6 +21,8 @@
 
 // Enable debugging
 phpCAS::setDebug();
+// Enable verbose error messages. Disable in production!
+phpCAS::setVerbose(true);
 
 // Initialize phpCAS
 phpCAS::proxy(CAS_VERSION_2_0, $cas_host, $cas_port, $cas_context);

diff --git a/docs/examples/example_proxy_GET.php b/docs/examples/example_proxy_GET.php
@@ -21,6 +21,8 @@
 
 // Enable debugging
 phpCAS::setDebug();
+// Enable verbose error messages. Disable in production!
+phpCAS::setVerbose(true);
 
 // Initialize phpCAS
 phpCAS::proxy(CAS_VERSION_2_0, $cas_host, $cas_port, $cas_context);

diff --git a/docs/examples/example_proxy_POST.php b/docs/examples/example_proxy_POST.php
@@ -21,6 +21,8 @@
 
 // Enable debugging
 phpCAS::setDebug();
+// Enable verbose error messages. Disable in production!
+phpCAS::setVerbose(true);
 
 // Initialize phpCAS
 phpCAS::proxy(CAS_VERSION_2_0, $cas_host, $cas_port, $cas_context);

diff --git a/docs/examples/example_proxy_rebroadcast.php b/docs/examples/example_proxy_rebroadcast.php
@@ -22,6 +22,8 @@
 
 // Enable debugging
 phpCAS::setDebug();
+// Enable verbose error messages. Disable in production!
+phpCAS::setVerbose(true);
 
 // Initialize phpCAS
 phpCAS::proxy(CAS_VERSION_2_0, $cas_host, $cas_port, $cas_context);

diff --git a/docs/examples/example_proxy_serviceWeb.php b/docs/examples/example_proxy_serviceWeb.php
@@ -21,6 +21,8 @@
 
 // Enable debugging
 phpCAS::setDebug();
+// Enable verbose error messages. Disable in production!
+phpCAS::setVerbose(true);
 
 // Initialize phpCAS
 phpCAS::proxy(CAS_VERSION_2_0, $cas_host, $cas_port, $cas_context);

diff --git a/docs/examples/example_proxy_serviceWeb_chaining.php b/docs/examples/example_proxy_serviceWeb_chaining.php
@@ -21,6 +21,8 @@
 
 // Enable debugging
 phpCAS::setDebug();
+// Enable verbose error messages. Disable in production!
+phpCAS::setVerbose(true);
 
 // Initialize phpCAS
 phpCAS::proxy(CAS_VERSION_2_0, $cas_host, $cas_port, $cas_context);

diff --git a/docs/examples/example_renew.php b/docs/examples/example_renew.php
@@ -21,6 +21,8 @@
 
 // Enable debugging
 phpCAS::setDebug();
+// Enable verbose error messages. Disable in production!
+phpCAS::setVerbose(true);
 
 // Initialize phpCAS
 phpCAS::client(CAS_VERSION_2_0, $cas_host, $cas_port, $cas_context);

diff --git a/docs/examples/example_service.php b/docs/examples/example_service.php
@@ -21,6 +21,8 @@
 
 // Enable debugging
 phpCAS::setDebug();
+// Enable verbose error messages. Disable in production!
+phpCAS::setVerbose(true);
 
 // Initialize phpCAS
 phpCAS::client(CAS_VERSION_2_0, $cas_host, $cas_port, $cas_context);

diff --git a/docs/examples/example_service_POST.php b/docs/examples/example_service_POST.php
@@ -21,6 +21,8 @@
 
 // Enable debugging
 phpCAS::setDebug();
+// Enable verbose error messages. Disable in production!
+phpCAS::setVerbose(true);
 
 // Initialize phpCAS
 phpCAS::client(CAS_VERSION_2_0, $cas_host, $cas_port, $cas_context);

diff --git a/docs/examples/example_service_that_proxies.php b/docs/examples/example_service_that_proxies.php
@@ -21,6 +21,8 @@
 
 // Enable debugging
 phpCAS::setDebug();
+// Enable verbose error messages. Disable in production!
+phpCAS::setVerbose(true);
 
 // Initialize phpCAS
 phpCAS::proxy(CAS_VERSION_2_0, $cas_host, $cas_port, $cas_context);

diff --git a/docs/examples/example_simple.php b/docs/examples/example_simple.php
@@ -21,6 +21,8 @@
 
 // Enable debugging
 phpCAS::setDebug();
+// Enable verbose error messages. Disable in production!
+phpCAS::setVerbose(true);
 
 // Initialize phpCAS
 phpCAS::client(CAS_VERSION_2_0, $cas_host, $cas_port, $cas_context);

diff --git a/source/CAS.php b/source/CAS.php
@@ -138,6 +138,11 @@
  */
 define("SAML_ATTRIBUTES", 'SAMLATTRIBS');
 
+/**
+ * SAML Attributes
+ */
+define("DEFAULT_ERROR", 'Internal script failure');
+
 /** @} */
 /**
  * @addtogroup publicPGTStorage
@@ -297,6 +302,13 @@ class phpCAS
      */
     private static $_PHPCAS_DEBUG;
 
+    /**
+     * This variable is used to store phpCAS debug mode.
+     *
+     * @hideinitializer
+     */
+    private static $_PHPCAS_VERBOSE = false;
+
 
     // ########################################################################
     //  INITIALIZATION
@@ -456,6 +468,34 @@ public static function setDebug($filename = '')
         }
     }
 
+    /**
+     * Enable verbose errors messages in the website output
+     * This is a security relevant since internal status info may leak an may
+     * help an attacker
+     *
+     * @param bool $verbose enable verbose output
+     *
+     * @return void
+     */
+    public static function setVerbose($verbose)
+    {
+        if ($verbose === true) {
+            self::$_PHPCAS_VERBOSE = true;
+        } else {
+            self::$_PHPCAS_VERBOSE = false;
+        }
+    }
+
+
+    /**
+     * Show is verbose mode is on
+     *
+     * @return boot verbose
+     */
+    public static function getVerbose()
+    {
+        return self::$_PHPCAS_VERBOSE;
+    }
 
     /**
      * Logs a string in debug mode.
@@ -501,6 +541,7 @@ public static function log($str)
      */
     public static function error($msg)
     {
+        phpCAS :: traceBegin();
         $dbg = debug_backtrace();
         $function = '?';
         $file = '?';
@@ -516,8 +557,12 @@ public static function error($msg)
                 }
             }
         }
-        echo "<br />\n<b>phpCAS error</b>: <font color=\"FF0000\"><b>" . __CLASS__ . "::" . $function . '(): ' . htmlentities($msg) . "</b></font> in <b>" . $file . "</b> on line <b>" . $line . "</b><br />\n";
-        phpCAS :: trace($msg);
+        if (self::$_PHPCAS_VERBOSE) {
+            echo "<br />\n<b>phpCAS error</b>: <font color=\"FF0000\"><b>" . __CLASS__ . "::" . $function . '(): ' . htmlentities($msg) . "</b></font> in <b>" . $file . "</b> on line <b>" . $line . "</b><br />\n";
+        } else {
+            echo "<br />\n<b>Error</b>: <font color=\"FF0000\"><b>". DEFAULT_ERROR ."</b><br />\n";
+        }
+        phpCAS :: trace($msg . ' in ' . $file . 'on line ' . $line );
         phpCAS :: traceEnd();
 
         throw new CAS_GracefullTerminationException(__CLASS__ . "::" . $function . '(): ' . $msg);
@@ -537,7 +582,8 @@ public static function trace($str)
     }
 
     /**
-     * This method is used to indicate the start of the execution of a function in debug mode.
+     * This method is used to indicate the start of the execution of a function
+     * in debug mode.
      *
      * @return void
      */

diff --git a/source/CAS/Client.php b/source/CAS/Client.php
@@ -131,9 +131,11 @@ public function printHTMLFooter()
         $lang = $this->getLangObj();
         $this->_htmlFilterOutput(
             empty($this->_output_footer)?
-            ('<hr><address>phpCAS __PHPCAS_VERSION__ '
-            .$lang->getUsingServer()
-            .' <a href="__SERVER_BASE_URL__">__SERVER_BASE_URL__</a> (CAS __CAS_VERSION__)</a></address></body></html>')
+            (phpcas::getVerbose())?
+                '<hr><address>phpCAS __PHPCAS_VERSION__ '
+                .$lang->getUsingServer()
+                .' <a href="__SERVER_BASE_URL__">__SERVER_BASE_URL__</a> (CAS __CAS_VERSION__)</a></address></body></html>'
+                :'</body></html>'
             :$this->_output_footer
         );
     }
@@ -3619,7 +3621,7 @@ private function _renameSession($ticket)
                 phpCAS :: trace("Restoring old session vars");
                 $_SESSION = $old_session;
             } else {
-                phpCAS :: error(
+                phpCAS :: trace (
                     'Session should only be renamed after successfull authentication'
                 );
             }