diff --git a/phpBB/includes/error_collector.php b/phpBB/includes/error_collector.php
index 55834f354c..3c0a89a1f3 100644
--- a/phpBB/includes/error_collector.php
+++ b/phpBB/includes/error_collector.php
@@ -49,13 +49,15 @@ class phpbb_error_collector
{
$text .= "
\n";
}
+
list($errno, $msg_text, $errfile, $errline) = $error;
- $text .= "Errno $errno: $msg_text";
- if (defined('DEBUG_EXTRA') || defined('IN_INSTALL'))
- {
- $text .= " at $errfile line $errline";
- }
+
+ // Prevent leakage of local path to phpBB install
+ $errfile = phpbb_filter_root_path($errfile);
+
+ $text .= "Errno $errno: $msg_text at $errfile line $errline";
}
+
return $text;
}
}
diff --git a/phpBB/includes/functions.php b/phpBB/includes/functions.php
index 0d0b431cc2..a20e896126 100644
--- a/phpBB/includes/functions.php
+++ b/phpBB/includes/functions.php
@@ -3759,9 +3759,8 @@ function msg_handler($errno, $msg_text, $errfile, $errline)
if (strpos($errfile, 'cache') === false && strpos($errfile, 'template.') === false)
{
- // remove complete path to installation, with the risk of changing backslashes meant to be there
- $errfile = str_replace(array(phpbb_realpath($phpbb_root_path), '\\'), array('', '/'), $errfile);
- $msg_text = str_replace(array(phpbb_realpath($phpbb_root_path), '\\'), array('', '/'), $msg_text);
+ $errfile = phpbb_filter_root_path($errfile);
+ $msg_text = phpbb_filter_root_path($msg_text);
$error_name = ($errno === E_WARNING) ? 'PHP Warning' : 'PHP Notice';
echo '[phpBB Debug] ' . $error_name . ': in file ' . $errfile . ' on line ' . $errline . ': ' . $msg_text . '
' . "\n";
@@ -3939,6 +3938,29 @@ function msg_handler($errno, $msg_text, $errfile, $errline)
return false;
}
+/**
+* Removes absolute path to phpBB root directory from error messages
+* and converts backslashes to forward slashes.
+*
+* @param string $errfile Absolute file path
+* (e.g. /var/www/phpbb3/phpBB/includes/functions.php)
+* Please note that if $errfile is outside of the phpBB root,
+* the root path will not be found and can not be filtered.
+* @return string Relative file path
+* (e.g. /includes/functions.php)
+*/
+function phpbb_filter_root_path($errfile)
+{
+ static $root_path;
+
+ if (empty($root_path))
+ {
+ $root_path = phpbb_realpath(dirname(__FILE__) . '/../');
+ }
+
+ return str_replace(array($root_path, '\\'), array('[ROOT]', '/'), $errfile);
+}
+
/**
* Queries the session table to get information about online guests
* @param int $item_id Limits the search to the item with this id
diff --git a/tests/error_collector_test.php b/tests/error_collector_test.php
new file mode 100644
index 0000000000..e1ac32f5ac
--- /dev/null
+++ b/tests/error_collector_test.php
@@ -0,0 +1,35 @@
+install();
+
+ // Cause a warning
+ 1/0; $line = __LINE__;
+
+ $collector->uninstall();
+
+ list($errno, $msg_text, $errfile, $errline) = $collector->errors[0];
+ $error_contents = $collector->format_errors();
+
+ $this->assertEquals($errno, 2);
+
+ // Unfortunately $error_contents will contain the full path here,
+ // because the tests directory is outside of phpbb root path.
+ $this->assertStringStartsWith('Errno 2: Division by zero at ', $error_contents);
+ $this->assertStringEndsWith(" line $line", $error_contents);
+ }
+}