User tests: Successful: Unsuccessful:
Pull Request for Issue - Currently if we provide wrong userid/password Joomla attempts to write the error in log file. If the permission is denied, call stack is shown instead of telling for which dir permissions are denied.
Checks if log dir is writable or not, if not displays for which dir permission is denied so that site admin can rectify it.
Error with call stack
Status | New | ⇒ | Pending |
Category | ⇒ | Libraries |
Title |
|
This is totally wrong, IMO. Path should not be exposed. It's a security risk. You're seeing call stack because you have debug enabled in PHP. It should not be enabled in production environment.
Instead of changing the file write function you should check the return code any may use the com_message component to notify all super users.
If you interested to do this then please use the 4.0 branch.
The correct way to do this would be to handle it the same as all the other system environment warnings such as php temp folder not set and display the warning in the dedicated warnings area.
Not in the frontend or at backend login, this would be an information disclosure that login monitoring didn't work.
@HLeithner thats exactly why I said what I said. The dedicated warnings are is only in the admin. I am NOT talking about the messages area!!
ok then I miss understood this.
Title |
|
@HLeithner should this PR be closed (don't know if "The correct way to do this would be to handle it the same as all the other system environment warnings")?
This PR is wrong, we should raise an exception if we can't write to file but that can't be done in J3.
Return false without a way to debug it isn't better. Better to write this warning in debug mode as no error message.
Status | Pending | ⇒ | Closed |
Closed_Date | 0000-00-00 00:00:00 | ⇒ | 2019-04-24 08:41:03 |
Closed_By | ⇒ | HLeithner | |
Labels |
Added:
?
Removed: J3 Issue ? |
@puneet0191 @astridx What do you think about it, I think displaying which dir has the problem is better than displaying PHP error call stack which doesn't tell user what the actual problem is