1
I have noticed that debbuging info is being displayed to everybody and not just for admins (as in 2.0.18)
We can find the reason at class/logger.php around line 167:
/**
* Output buffering callback inserting logger dump in page output
*/
function render( $output ) {
global $xoopsUser;
if ( !$this->activated/* || !$xoopsUser || !$xoopsUser->isAdmin()*/ ) {
return $output;
}
$this->renderingEnabled = $this->activated = false;
$log = $this->dump( $this->usePopup ? 'popup' : '' );
$pattern = '<!--{xo-logger-output}-->';
$pos = strpos( $output, $pattern );
if ( $pos !== false ) {
return substr( $output, 0, $pos ) . $log . substr( $output, $pos + strlen( $pattern ) );
} else {
return $output . $log;
}
}
As you can see the check was commented out.
My question is:
Is this a bug or a feature?
IMHO, I like to be able to debug my site without having to close it.
Showing debug info to anonymous is a serious security risk ( and is not pretty).
Thanks.
