Information disclosure on error messages

[Nicals]

Continuation of discussion started on unmaintained repository.

As said in the issue above: Shaarli have a problem with its error logging process. It discloses too much information:

• Full path disclosure here
• PHP version leak
• obsolete version disclosure
• and so on...

The correct way to report errors on a website is not to use die, it is to return a HTTP 500 response with a generic error message. You can display a generic message and add a line in a log file. The message could suggest the user to check its log for more information.

[nodiscc]

@Nicals thanks for the bug report.

• Yes we could remove ('.realpath(dirname(__FILE__)).') line92 so as not to disclose the path.
• PHP version leak: we can use the suggested wording in Please, don't tell the world which PHP version I'm running sebsauvage/Shaarli#214: Your PHP version is obsolete! Shaarli requires at least php 5.1.0, and thus cannot run. Sorry. Your PHP version has known security vulnerabilities and should be updated as soon as possible.
• obsolete version disclosure: this is only visible to the logged in user, and should stay visible to the user/admin no notify them of available updates, see Make update check optional #34

What do you think?

[nodiscc]

By the way the Shaarli version number can also be probed by accessing shaarli-version.txt

[dper]

Is PHP version leaking a serious issue? As we know, most automated attacks (on whatever server software) try many different vulnerabilities from many different versions.

[pVesian]

You'd also have to control the headers that are sent by the server. Example for http://sebsauvage.net/links/:
Server:Apache/2.2.20 (Unix) mod_ssl/2.2.20 OpenSSL/0.9.8o
X-Powered-By:PHP/5.3.8-pl0-gentoo

[nodiscc]

These headers should be hidden from your webserver configuration (as well as setting ServerTokens to Prod and a few other things). The PHP version leaking is not a serious problem, but it is good practice not to disclose it. The full path disclosure is not nice. This only happens in very special circumstances, but should be fixed anyway.

[nodiscc]

Fixed in #81