# mail.add_x_header set to on in php.ini-production - Thread: https://externals.io/message/57532 - Original archive: https://news-web.php.net/php.internals/57532 - Started by Martin Jansen on 2012-01-27T09:37:54+00:00 - Messages: 2 - Reply by email to internals@lists.php.net - More for agents: search with https://externals.io/search.md?q={query} · JSON API at https://externals.io/api · documentation at https://externals.io/llms.txt --- ## #57532 — Martin Jansen — 2012-01-27T09:37:54+00:00 URL: https://externals.io/message/57532#57532 Is there any intention behind enabling the mail.add_x_header configuration directive in php.ini-production? http://lxr.php.net/opengrok/xref/PHP_TRUNK/php.ini-production#1018 This setting exposes (sort of) sensitive information about application deployments to third parties while IMO having no apparent advantage for production environments. The trivial patch to revert this behavior is attached in case you agree with me. - Martin --- ## #57533 — Michael Shadle — 2012-01-27T10:06:55+00:00 URL: https://externals.io/message/57532#57533 · In reply to: #57532 Personally I would want to have an audit log of emails on production. That actually is probably more important to me than non-production environments :) > Is there any intention behind enabling the mail.add_x_header > configuration directive in php.ini-production? > > http://lxr.php.net/opengrok/xref/PHP_TRUNK/php.ini-production#1018 > > This setting exposes (sort of) sensitive information about application > deployments to third parties while IMO having no apparent advantage for > production environments. The trivial patch to revert this behavior is > attached in case you agree with me. > > - Martin >