Re: display_errors = on
| From: | Jeff Moore | Date: | Sun, 17 Dec 2006 21:09:16 +0000 |
| Subject: | Re: display_errors = on | ||
| References: | 1 | Groups: | php.internals |
| Request: | Send a blank email to internals+get-27060@lists.php.net to get a copy of this message | ||
On Dec 15, 2006, at 7:47 PM, Andi Gutmans wrote:
Time to turn it off in php.ini-dist in addition to php.ini-recommended?Time to rename php.ini-dist and a php.ini-recommended to more clearly represent specific usage profiles, like development and production? Perhaps the production or "recommended" profile should be the default php.ini installed?
-----Original Message----- From: Ilia Alshanetsky [mailto:iliaal@gmail.com] On Behalf Of Ilia Alshanetsky Sent: Friday, December 15, 2006 4:04 PM To: Stanislav Malyshev Cc: PHP internals Subject: Re: [PHP-DEV] Run-time taint support proposal On 15-Dec-06, at 7:01 PM, Stanislav Malyshev wrote:-- PHP Internals - PHP Runtime Development Mailing List To unsubscribe, visit: http://www.php.net/unsub.phpdisclosure is tothe harm. One simple exploit leading to informationerror exposingpass it an array() causing the function to generate anSomething that most servers do (almost 80% by recent stats). http://www.nexen.net/images/stories/phpinfos/display_errors.png Ilia Alshanetsky -- PHP Internals - PHP Runtime Development Mailing List To unsubscribe, visit: http://www.php.net/unsub.phpthe script's path.You mean when running with display_errors = on? Ouch.
