I think tumblr has a huge security hole

Re:I think tumblr has a huge security hole by Loic on Saturday March 19, 2011 @08:51AM (#2343462)

Just put: display_errors = Off is your php.ini and you will never see any errors. This is recommended everywhere for a PHP deployment.

    ; This directive controls whether or not and where PHP will output errors,
    ; notices and warnings too. Error output is very useful during development, but
    ; it could be very dangerous in production environments. Depending on the code
    ; which is triggering the error, sensitive information could potentially leak
    ; out of your application such as database usernames and passwords or worse.
    ; It's recommended that errors be logged on production servers rather than
    ; having the errors sent to STDOUT.
    ; Possible Values:
    ;   Off = Do not display any errors
    ;   stderr = Display errors to STDERR (affects only CGI/CLI binaries!)
    ;   On or stdout = Display errors to STDOUT
    ; Default Value: On
    ; Development Value: On
    ; Production Value: Off
    ; http://php.net/display-errors
    display_errors = Off

[ Parent | on HN ]

Re:I think tumblr has a huge security hole by russss on Saturday March 19, 2011 @09:03AM (#2343481)

I guarantee you that Tumblr has display_errors = Off. This wasn't a display_errors related fuckup, it was a missed opening PHP tag.

[ Parent | on HN ]

Re:I think tumblr has a huge security hole by nbpoole on Saturday March 19, 2011 @09:49AM (#2343560)

Well, based on the code that was dumped, it looks like they're using their own error handler which was ignoring display_errors (search for "Use of undefined constant" in the dump).

[ Parent | on HN ]

Re:I think tumblr has a huge security hole by CWIZO on Saturday March 19, 2011 @10:05AM (#2343594)

That custom error handler was never set, because the code you see above never even executed. The reason was, like said many times already, a miss-typed opening PHP tag, which tells PHP where PHP code is. If that tag is missing or miss-typed the code is just returned to the browser like HTML.

The point is that no server configuration can save you from an error like this.

[ Parent | on HN ]

Re:I think tumblr has a huge security hole by moe on Saturday March 19, 2011 @11:08AM (#2343760)

The point is that no server configuration can save you from an error like this.

Huh? Yes you can protect against errors like this; http://news.ycombinator.com/item?id=2343675

[ Parent | on HN ]

Re:I think tumblr has a huge security hole by eli on Saturday March 19, 2011 @11:34AM (#2343808)

Well, off the top of my head, mod_security has rules that scan outgoing data for password or code leakage.

A deployment strategy that requires testing that pages show what you expect them to show would also likely catch it.

[ Parent | on HN ]

Re:I think tumblr has a huge security hole by nbpoole on Saturday March 19, 2011 @10:38AM (#2343678)

If the custom error handler was never set, the PHP notices wouldn't look like that.

[ Parent | on HN ]

Re:I think tumblr has a huge security hole by KevBurnsJr on Saturday March 19, 2011 @09:11AM (#2343506)

Well, this is partially true. The output clearly contains error statements, but this directive would not have stopped the first 748 lines of sensitive information from leaking before the first error.

[ Parent | on HN ]