Skip to content

Commit

Permalink
Debugger::enable() calls die() instead of throwing error as preventio…
Browse files Browse the repository at this point in the history
…n of Full Path Disclosure
  • Loading branch information
dg committed Aug 31, 2012
1 parent 4d6e0d2 commit f2b7022
Showing 1 changed file with 3 additions and 3 deletions.
6 changes: 3 additions & 3 deletions Nette/Diagnostics/Debugger.php
Expand Up @@ -243,7 +243,7 @@ public static function enable($mode = NULL, $logDirectory = NULL, $email = NULL)
if (is_string($logDirectory)) {
self::$logDirectory = realpath($logDirectory);
if (self::$logDirectory === FALSE) {
throw new Nette\DirectoryNotFoundException("Directory '$logDirectory' is not found.");
die(__METHOD__ . "() error: Log directory is not found or is not directory.");
}
} elseif ($logDirectory === FALSE) {
self::$logDirectory = FALSE;
Expand All @@ -262,12 +262,12 @@ public static function enable($mode = NULL, $logDirectory = NULL, $email = NULL)
ini_set('log_errors', FALSE);

} elseif (ini_get('display_errors') != !self::$productionMode && ini_get('display_errors') !== (self::$productionMode ? 'stderr' : 'stdout')) { // intentionally ==
throw new Nette\NotSupportedException('Function ini_set() must be enabled.');
die(__METHOD__ . "() error: Unable to set 'display_errors' because function ini_set() is disabled.");
}

if ($email) {
if (!is_string($email)) {
throw new Nette\InvalidArgumentException('Email address must be a string.');
die(__METHOD__ . '() error: Email address must be a string.');
}
self::$email = $email;
}
Expand Down

5 comments on commit f2b7022

@Majkl578
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Maybe 500 Internal Server Error header should be sent before die()?

@dg
Copy link
Member Author

@dg dg commented on f2b7022 Sep 3, 2012

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Would you like to support PHP < 5.2.4? ;-)

@Majkl578
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I didn't get your comment. On both nginx and Apache 2.4 in combination with PHP FPM 5.4.7, it sends 200 OK instead of 500.

@fprochazka
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Context: php/php-src@e1f08c8

It sends the header only if is set display_errors = 0 and when triggering an error. die() is not an error.

@dg
Copy link
Member Author

@dg dg commented on f2b7022 Sep 3, 2012

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Sorry, my mistake.

Please sign in to comment.