note 107378 added to security.filesystem

I note that the php standard error printing includes "filename", which appears to always be the /full/folder/path/and/filename. And on all unix systems and by common practice on many windows systems, the /home/(control panel login id)/ is part of the folder path, and on most hosts the same account login id is the control panel login id. So any error message effectively exposes to the world the control panel login id. From there a hacker and brute force can break any password in time. PHP does not appear to have a way to disable displaying the actual physical directory structure from appearing in error messages, which even is no login id were there, is a security problem. One can direct the error to a log file, but that still exposes critical information to contract web programmers. Typical practice is to give web programmers limited ftp access to a web directory, but then php defeats this restriction by displaying the entire directory structure in the error message to the web developer who you tried to give restricted access to. And 9 time out of ten also gave away the control panel login in id. So all the wise script writing in the world cannot obscure the private information the php error printing is giving out. Can it? ---- Server IP: 69.147.83.197 Probable Submitter: 99.18.231.227 ---- Manual Page -- http://www.php.net/manual/en/security.filesystem.php Edit -- https://master.php.net/note/edit/107378 Del: integrated -- https://master.php.net/note/delete/107378/integrated Del: useless -- https://master.php.net/note/delete/107378/useless Del: bad code -- https://master.php.net/note/delete/107378/bad+code Del: spam -- https://master.php.net/note/delete/107378/spam Del: non-english -- https://master.php.net/note/delete/107378/non-english Del: in docs -- https://master.php.net/note/delete/107378/in+docs Del: other reasons-- https://master.php.net/note/delete/107378 Reject -- https://master.php.net/note/reject/107378 Search -- https://master.php.net/manage/user-notes.php