Bug #54114 [Opn->Fbk]: Output Buffer Dumps Data On Error

Edit report at http://bugs.php.net/bug.php?id=54114&edit=1 ID: 54114 Updated by: rasmus@php.net Reported by: danhstevens at gmail dot com Summary: Output Buffer Dumps Data On Error -Status: Open +Status: Feedback Type: Bug Package: Output Control Operating System: all PHP Version: 5.3.5 Block user comment: N Private report: N New Comment: I am unable to reproduce this. My test script: <?php function eh($errno, $errstr, $errfile, $errline) { $contents = ob_get_contents(); ob_end_clean(); echo "Error: $errno, $errstr, $errfile, $errline\n"; } set_error_handler('eh'); ob_start(); echo 123; trigger_error('test error', E_USER_ERROR); echo "After error\n"; And my output is: Error: 256, test error, /var/www/testing/o.php, 10 After error No sign of "123" there. Previous Comments: ------------------------------------------------------------------------ [2011-02-28 07:43:46] danhstevens at gmail dot com Description: ------------ When output buffering is turned on (via ob_start()) and an error is encountered before a call to ob_end_* is called the entire contents of the output buffer is dumped (to STDOUT) and there appears to be no way to prevent the buffer from dumping - not even by setting an error handler, etc. This is a security issue since the output buffer may contain sensitive information that is them dumped over to the user. Using set_error_handler does not stop the dump - it appears the dump simply happens with no way to intercept or prevent it. Test script: --------------- <?php ob_start(); echo 123; trigger_error('test error', E_USER_ERROR); $contents = ob_get_contents(); ob_end_clean(); ?> Expected result: ---------------- (no output) Actual result: -------------- 123 Fatal error: test error in ... ------------------------------------------------------------------------ -- Edit this bug report at http://bugs.php.net/bug.php?id=54114&edit=1