[BUGFIX] disable php error reporting by default

wrong permission configuration migth trigger error or warning message leaking location of var-folder.

ref #238

Signed-off-by: Jerome Jutteau <jerome@jutteau.fr>

diff --git a/README.md b/README.md
index 37fdfc7593ab784bc0b3556503631f6317700593..3cebad52d0c4f7fd1cb5b6691abc69fc985b8a2b 100644 (file)
--- a/README.md
+++ b/README.md
@@ -80,6 +80,7 @@ If you have some troubles, consider the following cases
 
 - Check your ```/lib/config.local.php``` file and compare it with ```/lib/config.original.php```, the configuration syntax or a parameter may have changed
 - Check owner & permissions of your files
+- set `debug` option to `true` to check any warning or error
 
 ## Security
 

diff --git a/lib/config.original.php b/lib/config.original.php
index f5229440499268f6f8f54bfb35f08f52585bfbec..f1f0368b2afa981ff22e10389c658eadbc578e68 100644 (file)
--- a/lib/config.original.php
+++ b/lib/config.original.php
@@ -180,3 +180,10 @@ $cfg['litespeed_workaround'] = false;
  * or needs to start the installation script
  */
 $cfg['installation_done'] = false;
+
+/* Enable this debug flag to allow eventual PHP error reporting.
+ * This is disabled by default permission misconfiguration might generate warnings or errors.
+ * Those warnings can break Jirafeau and also show path to var- folder in debug messages.
+ * var- folder should kept secret and accessing it may lead to data leak if unprotected.
+ */
+$cfg['debug'] = false;

diff --git a/lib/settings.php b/lib/settings.php
index 9bccc86069215cf78abf058268b7c1a0a4a7f75b..c520412bd3ae8ac397ec46703ec8938de7e0dd07 100644 (file)
--- a/lib/settings.php
+++ b/lib/settings.php
@@ -29,6 +29,13 @@ if (file_exists(JIRAFEAU_ROOT . 'lib/config.local.php')) {
     unset($cfgOriginal);
 }
 
+// Setup debug mode
+error_reporting(0);
+if ($cfg['debug'] === true)
+{
+    error_reporting(E_ALL);
+}
+
 // Set constants
 
 /* Jirafeau package */