You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
Usually, we set the database password in the .env file, the security encryption string.
If $_SERVER have this info. It will become unsafe.
If the programmer forgets to delete the debugging information, the information will be exposed.
example:
The text was updated successfully, but these errors were encountered:
@michalsn
I mean, $_SERVER should not contain .env information.
.env often contains sensitive information.
If the system has some vulnerabilities, only need to print $_SERVER, important information such as database password will be exposed.
These are environment variables so they should be set to $_SERVER too. If we stop setting these variables into $_SERVER it will introduce a BC change. Also, I don't really understand what type of vulnerabilities you're talking about.
Debugging with helper functions such as d() or dd() doesn't work in production. So if you somehow forgot to remove this type of call from your code, you will still be safe.
CodeIgniter4/system/Config/DotEnv.php
Lines 151 to 154 in 473a8f5
Usually, we set the database password in the .env file, the security encryption string.
If $_SERVER have this info. It will become unsafe.
If the programmer forgets to delete the debugging information, the information will be exposed.
example:
The text was updated successfully, but these errors were encountered: