php.net |  support |  documentation |  report a bug |  advanced search |  search howto |  statistics |  random bug |  login
Request #8391 as Apache module, PHP errors should not reveal absolute file paths
Submitted: 2000-12-23 19:46 UTC Modified: 2000-12-23 20:49 UTC
From: madizen at tds dot net Assigned:
Status: Closed Package: Feature/Change Request
PHP Version: 4.0.3pl1 OS: FreeBSD 4.2-STABLE
Private report: No CVE-ID: None
Welcome back! If you're the original bug submitter, here's where you can edit the bug or add additional notes.
If you forgot your password, you can retrieve your password here.
Password:
Status:
Package:
Bug Type:
Summary:
From: madizen at tds dot net
New email:
PHP Version: OS:

 

 [2000-12-23 19:46 UTC] madizen at tds dot net
When PHP is installed as an Apache module (using Apache and PHP port installers from FreeBSD), and a script contains syntax errors or encounters problems while in use (e.g. unable to open a file with fopen), errors are reported to the browser window which reveal the absolute file path to the script rather than the relative path known by Apache, e.g. /private/database/area/php/script.php instead of /php/script.php, assuming the Apache root document directory is /private/database/area/. In several other instances, similar problems with web products (IIS, et. al.) revealing the absolute paths to their virtual environments have been labeled "bugs" or "security leaks". Please consider whether the absolute path can/should be masked whenever discretion can be obtained. I apologize if this is a configurable behavior and I just can't find the toggle, but perhaps discretion should be the default behavior if such a toggle exists. Thank you for your consideration.

Patches

Pull Requests

History

AllCommentsChangesGit/SVN commitsRelated reports
 [2000-12-23 20:49 UTC] jmoore@php.net
On prduction sites error reporting should be set so that
display_errors	= off in your php.ini to keep this information secret.

James
 
PHP Copyright © 2001-2026 The PHP Group
All rights reserved.
Last updated: Fri Jun 19 03:00:01 2026 UTC