Page MenuHomePhabricator

$wgShowExceptionDetails should be per default enabled
Closed, DeclinedPublic

Description

$wgShowExceptionDetails is configuration setting which shows more detailed output about error which happens.

Default value is false, so users are shown only an error message "Fatal exception of type MWException" with an alphanumeric code that a person with access to the server logs can use to find the stack trace.

I think to we should change default value to true, as usually we suggest users to do when report some problem, so always user can get detailed information about error.

Event Timeline

MGChecker added a project: acl*security.
MGChecker subscribed.

This would probably a very large security threat, especially if we change the default vlaue now.

Reedy subscribed.

Yeah, I'm declining.

It should only be enabled by default for development wikis, or if the sysadmin knows what they're doing while debugging stuff

While at Wikimedia we don't see path disclosure as an issue (because the config is all public), it is definitely a concern for third party wikis