Details
-
Bug
-
Resolution: Fixed
-
Minor
-
None
-
Professional Edition
-
None
-
Centos 7 and apache 2.4 with php 5.4.16 with all security patches from centos repos.
Description
Hello, I see small security bug, when I make request to observium server like: https://servername/&debug, I can see debug information from server.
As I see, the issue on definitions.inc.php
in section debug.
// Set DEBUG
if (isset($options['d']))
{
// CLI
echo("DEBUG!\n");
define('OBS_DEBUG', count($options['d'])); // -d == 1, -dd == 2..
ini_set('display_errors', 1);
ini_set('display_startup_errors', 1);
ini_set('log_errors', 1);
if (OBS_DEBUG > 1)
else
{ ini_set('error_reporting', E_ERROR | E_PARSE | E_CORE_ERROR | E_COMPILE_ERROR); // Only various errors }}
else if ((isset($_SERVER['PATH_INFO']) && strpos($_SERVER['PATH_INFO'], 'debug')) ||
(isset($_SERVER['REQUEST_URI']) && strpos($_SERVER['REQUEST_URI'], 'debug')) ||
(isset($_REQUEST['debug']) && $_REQUEST['debug']))
{
// WEB
// Note, for security reasons set OBS_DEBUG constant in WUI moved to auth module
if (isset($config['web_debug_unprivileged']) && $config['web_debug_unprivileged'])
else
{ define('OBS_DEBUG_WUI', 1); // Temporary constant, for check in auth module } ini_set('display_errors', 1);
ini_set('display_startup_errors', 1);
ini_set('log_errors', 1);
ini_set('error_reporting', E_ALL ^ E_NOTICE);
//$vars['debug'] = 'yes';
} else