cvs: php4 / php.ini-dist php.ini-optimized
| From: | Zeev Suraski | Date: | Sat, 26 Aug 2000 14:25:47 +0000 |
| Subject: | cvs: php4 / php.ini-dist php.ini-optimized | ||
| Groups: | php.cvs | ||
| Request: | Send a blank email to php-cvs+get-1396@lists.php.net to get a copy of this message | ||
zeev Sat Aug 26 07:25:47 2000 EDT
Modified files:
/php4 php.ini-dist php.ini-optimized
Log:
Advise people to use error logging instead of error displaying on production web sites
Index: php4/php.ini-dist
diff -u php4/php.ini-dist:1.44 php4/php.ini-dist:1.45
--- php4/php.ini-dist:1.44 Tue Aug 15 02:47:35 2000
+++ php4/php.ini-dist Sat Aug 26 07:25:47 2000
@@ -161,8 +161,15 @@
; error_reporting = E_ALL & ~E_NOTICE ; show all errors, except for notices
; error_reporting = E_COMPILE_ERROR|E_ERROR|E_CORE_ERROR ; show only errors
error_reporting = E_ALL & ~E_NOTICE ; Show all errors except for notices
-display_errors = On ; Print out errors (as a part of the HTML script)
+display_errors = On ; Print out errors (as a part of the output)
+ ; For production web sites, you're strongly encouraged
+ ; to turn this feature off, and use error logging instead (see below).
+ ; Keeping display_errors enabled on a production web site may reveal
+ ; security information to end users, such as file paths on your Web server,
+ ; your database schema or other information.
log_errors = Off ; Log errors into a log file (server-specific log, stderr, or error_log (below))
+ ; As stated above, you're strongly advised to use error logging in place of
+ ; error displaying on production web sites.
track_errors = Off ; Store the last error/warning message in $php_errormsg (boolean)
;error_prepend_string = "<font color=ff0000>" ; string to output before an error
message
;error_append_string = "</font>" ; string to output after an error
message
Index: php4/php.ini-optimized
diff -u php4/php.ini-optimized:1.13 php4/php.ini-optimized:1.14
--- php4/php.ini-optimized:1.13 Sun Aug 20 21:09:13 2000
+++ php4/php.ini-optimized Sat Aug 26 07:25:47 2000
@@ -148,8 +148,15 @@
; error_reporting = E_ALL & ~E_NOTICE ; show all errors, except for notices
; error_reporting = E_COMPILE_ERROR|E_ERROR|E_CORE_ERROR ; show only errors
error_reporting = E_ALL & ~E_NOTICE ; Show all errors except for notices
-display_errors = On ; Print out errors (as a part of the HTML script)
+display_errors = On ; Print out errors (as a part of the output)
+ ; For production web sites, you're strongly encouraged
+ ; to turn this feature off, and use error logging instead (see below).
+ ; Keeping display_errors enabled on a production web site may reveal
+ ; security information to end users, such as file paths on your Web server,
+ ; your database schema or other information.
log_errors = Off ; Log errors into a log file (server-specific log, stderr, or error_log (below))
+ ; As stated above, you're strongly advised to use error logging in place of
+ ; error displaying on production web sites.
track_errors = Off ; Store the last error/warning message in $php_errormsg (boolean)
;error_prepend_string = "<font color=ff0000>" ; string to output before an error
message
;error_append_string = "</font>" ; string to output after an error
message