From f6e97b6e73be96e75ec606bda3d90126c69d7aee Mon Sep 17 00:00:00 2001 From: Fredrick Brennan Date: Mon, 19 May 2014 13:39:30 -0400 Subject: SECURITY: Remove $config[db][password] when $config[debug] is TRUE --- inc/display.php | 12 ++++++++++++ 1 file changed, 12 insertions(+) (limited to 'inc/display.php') diff --git a/inc/display.php b/inc/display.php index bcde41d0..8a6ab2bf 100644 --- a/inc/display.php +++ b/inc/display.php @@ -109,6 +109,18 @@ function error($message, $priority = true, $debug_stuff = false) { ))); } + $pw = $config['db']['password']; + $debug_callback = function(&$item) use (&$debug_callback, $pw) { + global $config; + if (is_array($item)) { + $item = array_filter($item, $debug_callback); + } + return ($item !== $pw || !$pw); + }; + + + $debug_stuff = array_filter($debug_stuff, $debug_callback); + die(Element('page.html', array( 'config' => $config, 'title' => _('Error'), -- cgit v1.3 From 56695fbf04ebcc34eafd6cb12719101be3546f73 Mon Sep 17 00:00:00 2001 From: Fredrick Brennan Date: Mon, 19 May 2014 13:46:18 -0400 Subject: No need for global config --- inc/display.php | 1 - 1 file changed, 1 deletion(-) (limited to 'inc/display.php') diff --git a/inc/display.php b/inc/display.php index 8a6ab2bf..dd8b1444 100644 --- a/inc/display.php +++ b/inc/display.php @@ -111,7 +111,6 @@ function error($message, $priority = true, $debug_stuff = false) { $pw = $config['db']['password']; $debug_callback = function(&$item) use (&$debug_callback, $pw) { - global $config; if (is_array($item)) { $item = array_filter($item, $debug_callback); } -- cgit v1.3 From b506c0be9f0146e01aed5e52c4f139388820ba20 Mon Sep 17 00:00:00 2001 From: 8chan Date: Tue, 27 May 2014 23:44:49 +0000 Subject: Fix array_filter error message when debug_stuff is false --- inc/display.php | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) (limited to 'inc/display.php') diff --git a/inc/display.php b/inc/display.php index dd8b1444..4e8ab8fb 100644 --- a/inc/display.php +++ b/inc/display.php @@ -118,7 +118,8 @@ function error($message, $priority = true, $debug_stuff = false) { }; - $debug_stuff = array_filter($debug_stuff, $debug_callback); + if ($debug_stuff) + $debug_stuff = array_filter($debug_stuff, $debug_callback); die(Element('page.html', array( 'config' => $config, -- cgit v1.3