On Monday 08 May 2006 04:49, you wrote:
> You state these problems exist at php.net and elsewhere, so why is the
> subject titled phpbb? =C2=A0php.net even recommends that for production s=
ites
> displaying of errors is discouraged. =C2=A0I'm unsure how your report bri=
ngs
> anything new as you specify the valid use of debug and displaying of
> errors which are already well known.

"Full Path Disclosure" isn't a risk but many systems of PHP or important si=
tes=20
are vulnerable to this issues. Of course it is possible to turn off=20
display_errors but it isn't changing the fact, that issues should not be. I=
t=20
is typical "Full Path Disclosure".=20
Yesterday I received the confirmation from phpBB about the acceptance of th=
ese=20
bug.
PHP is a specific language and are many different possibilities to show ful=
l=20
path. I will public note about this bugs.

=2D-=20
pub 1024D/7FDF4CEE 2005-09-21
uid Maksymilian Arciemowicz (cXIb8O3) <max@jestsuper.pl>
sub 2048g/AE816DB6 2005-09-21
SecurityReason.Com [Europe]