Newsgroups: php.internals
Path: news.php.net
Xref: news.php.net php.internals:105889
To: internals@lists.php.net
References: <dabdf489-0d4a-5be9-8858-83448dfd5d9a@lsces.uk>
 <CAF+90c81XGOeWex+nxTT+qyprUocsJ0QbnhAcF7qMxQc0TUUSg@mail.gmail.com>
 <b33877b2-0dce-c06f-f3ea-9f33746879a2@heigl.org>
Message-ID: <f32890f7-710a-0476-de04-399516a274fa@lsces.uk>
Date: Thu, 13 Jun 2019 09:36:42 +0100
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:60.0) Gecko/20100101
 Thunderbird/60.6.1
MIME-Version: 1.0
In-Reply-To: <b33877b2-0dce-c06f-f3ea-9f33746879a2@heigl.org>
Content-Type: text/plain; charset=utf-8; format=flowed
Content-Language: en-GB
Content-Transfer-Encoding: 7bit
X-thewebhostserver-MailScanner-Information: Please contact the ISP for more information
X-thewebhostserver-MailScanner-ID: 1hbLDu-004I8G-Bo
X-thewebhostserver-MailScanner: Found to be clean
X-thewebhostserver-MailScanner-SpamCheck: 
X-thewebhostserver-MailScanner-From: lester@lsces.uk
X-Spam-Status: No
X-AuthUser: lester@lsces.uk
Subject: Re: [PHP-DEV] The real world ...
From: lester@lsces.uk (Lester Caine)

On 13/06/2019 08:55, Andreas Heigl wrote:
>> display_errors=Off in production.

Which give a white screen ... fine for security but useless for people 
using the site!

> While that makes absolute sense perhaps thinking whether there is a way
> to mark password-parameters in core-functions and hide them in
> Stack-traces might improve security as that would also hide
> user-provided credentials in log-files.
> That would not target userland methods/functions. Though having a
> Core-Value-object for credentials might even allow*that*

Sanitising things would be a nice to have especially where log files are 
on 'cloud' storage, but the ability to give an end user some indication 
that there is a problem WHILE display_errors=Off would be helpful? I 
know the white screen problem has been discussed many time over the 
years ...

Personally I STILL use display_errors=on and just make sure that 
sensitive information is not displayed in the stack. Most of the time it 
IS just the warnings one gets and clients can report them and see they 
are cleared ... so some sort of middle ground between off and on would 
be helpful?

-- 
Lester Caine - G8HFL
-----------------------------
Contact - https://lsces.uk/wiki/Contact
L.S.Caine Electronic Services - https://lsces.uk
Model Engineers Digital Workshop - https://medw.uk
Rainbow Digital Media - https://rainbowdigitalmedia.uk