1
I have noticed that debbuging info is being displayed to everybody and not just for admins (as in 2.0.18)
We can find the reason at class/logger.php around line 167:
le="color: #000000"><?php /** * Output buffering callback inserting logger dump in page output */ function render( $output ) { global $xoopsUser; if ( !$this->activated/* || !$xoopsUser || !$xoopsUser->isAdmin()*/ ) { return $output; } $this->renderingEnabled = $this->activated = false; $log = $this->dump( $this->usePopup ? 'popup' : '' ); $pattern = '<!--{xo-logger-output}-->'; $pos = strpos( $output, $pattern ); if ( $pos !== false ) { return substr( $output, 0, $pos ) . $log . substr( $output, $pos + strlen( $pattern ) ); } else { return $output . $log; } }
As you can see the check was commented out.
My question is:
Is this a bug or a feature?
IMHO, I like to be able to debug my site without having to close it.
Showing debug info to anonymous is a serious security risk ( and is not pretty).
Thanks.
