? ? Failure

User tests: Successful: Unsuccessful:

avatar bahl24
bahl24
2 Mar 2019

Pull Request for Issue - Currently if we provide wrong userid/password Joomla attempts to write the error in log file. If the permission is denied, call stack is shown instead of telling for which dir permissions are denied.
screenshot from 2019-03-02 10-45-51

Summary of Changes

Checks if log dir is writable or not, if not displays for which dir permission is denied so that site admin can rectify it.

Testing Instructions

  1. Ensure that you don't have permission for log dir
  2. Try logging with incorrect password

Expected result

screenshot from 2019-03-02 10-56-23

Actual result

Error with call stack

avatar bahl24 bahl24 - open - 2 Mar 2019
avatar bahl24 bahl24 - change - 2 Mar 2019
Status New Pending
avatar joomla-cms-bot joomla-cms-bot - change - 2 Mar 2019
Category Libraries
avatar bahl24
bahl24 - comment - 2 Mar 2019

@puneet0191 @astridx What do you think about it, I think displaying which dir has the problem is better than displaying PHP error call stack which doesn't tell user what the actual problem is

avatar bahl24 bahl24 - change - 2 Mar 2019
Title
Display error when permission to write is denied
[RFC]Display error when permission to write is denied
avatar bahl24 bahl24 - edited - 2 Mar 2019
avatar SharkyKZ
SharkyKZ - comment - 2 Mar 2019

This is totally wrong, IMO. Path should not be exposed. It's a security risk. You're seeing call stack because you have debug enabled in PHP. It should not be enabled in production environment.

avatar bahl24
bahl24 - comment - 2 Mar 2019

@SharkyKZ I think if the log dir is not writable, then we should display some error, or its not needed?

avatar HLeithner
HLeithner - comment - 2 Mar 2019

Instead of changing the file write function you should check the return code any may use the com_message component to notify all super users.

If you interested to do this then please use the 4.0 branch.

avatar brianteeman
brianteeman - comment - 2 Mar 2019

The correct way to do this would be to handle it the same as all the other system environment warnings such as php temp folder not set and display the warning in the dedicated warnings area.

avatar HLeithner
HLeithner - comment - 2 Mar 2019

Not in the frontend or at backend login, this would be an information disclosure that login monitoring didn't work.

avatar brianteeman
brianteeman - comment - 2 Mar 2019

@HLeithner thats exactly why I said what I said. The dedicated warnings are is only in the admin. I am NOT talking about the messages area!!

avatar HLeithner
HLeithner - comment - 2 Mar 2019

ok then I miss understood this.

avatar franz-wohlkoenig franz-wohlkoenig - change - 19 Apr 2019
Title
[RFC]Display error when permission to write is denied
[RFC] Display error when permission to write is denied
avatar franz-wohlkoenig franz-wohlkoenig - edited - 19 Apr 2019
avatar franz-wohlkoenig
franz-wohlkoenig - comment - 24 Apr 2019

@HLeithner should this PR be closed (don't know if "The correct way to do this would be to handle it the same as all the other system environment warnings")?

avatar HLeithner
HLeithner - comment - 24 Apr 2019

This PR is wrong, we should raise an exception if we can't write to file but that can't be done in J3.

Return false without a way to debug it isn't better. Better to write this warning in debug mode as no error message.

avatar HLeithner HLeithner - change - 24 Apr 2019
Status Pending Closed
Closed_Date 0000-00-00 00:00:00 2019-04-24 08:41:03
Closed_By HLeithner
Labels Added: ?
Removed: J3 Issue ?
avatar HLeithner HLeithner - close - 24 Apr 2019

Add a Comment

Login with GitHub to post a comment