mirror/processwire
1
0
Fork 0
mirror of https://github.com/processwire/processwire.git synced 2025-08-10 00:37:02 +02:00
Code Issues Releases Wiki Activity

Update WireShutdown to support sanitization of debug backtraces

Browse Source
This commit is contained in:
Ryan Cramer
2025-08-01 16:34:57 -04:00
parent c1fb7264c8
commit dc89e16131
1 changed files with 39 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files

40
wire/core/WireShutdown.php
View File

@@ -90,6 +90,25 @@ class WireShutdown extends Wire {
*/
protected $error = array();
/**
* Methods that should have their arguments suppressed from PHP backtraces
*
* - Each method must include a `->`.
* - Methods should not include parenthesis.
* - If for specific class, include the class name before the `->`.
*
* @var string[]
*
*/
protected $banBacktraceMethods = array(
'->___login', // Session or ProcessLogin
'->___start', // i.e. Tfa
'->___setPass', // Password.php
'Session->___authenticate',
'Password->matches',
'Password->hash',
);
/**
* Default HTML to use for error message
*
@@ -188,6 +207,7 @@ class WireShutdown extends Wire {
protected function getErrorMessage(array $error) {
$type = $error['type'];
$config = $this->config;
if(isset($this->types[$type])) {
$errorType = $this->types[$type];
@@ -203,7 +223,25 @@ class WireShutdown extends Wire {
$detail = '';
}
return "$errorType: \t$message $detail ";
$message = "$errorType: \t$message $detail ";
if(strpos($message, '#1') !== false && stripos($message, '):')) {
// backtrace likely present in $message
// methods that should have their arguments excluded from backtrace
foreach($this->banBacktraceMethods as $name) {
if(strpos($message, "$name(") === false) continue;
if(!preg_match_all('!' . $name . '\([^\n]+\)!', $message, $matches)) continue;
foreach($matches[0] as $match) {
$message = str_replace($match, '->' . $name . '(...)', $message);
}
}
}
if(strlen((string) $config->dbPass) > 4) {
$message = str_replace((string) $config->dbPass, '[...]', $message);
}
return $message;
}
/**