MDL-20693 new NO_DEBUG_DISPLAY define

admin/dbperformance.php

@@ -1,12 +1,13 @@
 <?PHP
-       // dbperformance.php - shows latest ADOdb stats for the current server
+// dbperformance.php - shows latest ADOdb stats for the current server
 
-    require_once('../config.php');
+// disable moodle specific debug messages and any errors in output
+define('NO_DEBUG_DISPLAY', true);
+
+require_once('../config.php');
 
 error('TODO: rewrite db perf code'); // TODO: rewrite
 
-    // disable moodle specific debug messages that would be breaking the frames
-    disable_debugging();
 
     $topframe    = optional_param('topframe', 0, PARAM_BOOL);
     $bottomframe = optional_param('bottomframe', 0, PARAM_BOOL);

admin/report/unittest/coveragefile.php

@@ -29,16 +29,16 @@
  * @license    http://www.gnu.org/copyleft/gpl.html GNU GPL v3 or later
  */
 
+// disable moodle specific debug messages and any errors in output
+define('NO_DEBUG_DISPLAY', true);
+
 require_once(dirname(__FILE__) . '/../../../config.php');
 require_once($CFG->libdir . '/filelib.php');
 
 // basic security, require login + require site config cap
 require_login();
 require_capability('moodle/site:config', get_context_instance(CONTEXT_SYSTEM));
 
-// disable moodle specific debug messages
-disable_debugging();
-
 // get file requested
 $relativepath  = get_file_argument();
 

draftfile.php

@@ -24,6 +24,9 @@
  * @license    http://www.gnu.org/copyleft/gpl.html GNU GPL v3 or later
  */
 
+// disable moodle specific debug messages and any errors in output
+define('NO_DEBUG_DISPLAY', true);
+
 require_once('config.php');
 require_once('lib/filelib.php');
 
@@ -32,9 +35,6 @@
     print_error('noguest');
 }
 
-// disable moodle specific debug messages
-disable_debugging();
-
 $relativepath = get_file_argument();
 
 // relative path must start with '/'

file.php

@@ -31,6 +31,9 @@
  * @license    http://www.gnu.org/copyleft/gpl.html GNU GPL v3 or later
  */
 
+// disable moodle specific debug messages and any errors in output
+define('NO_DEBUG_DISPLAY', true);
+
 require_once('config.php');
 require_once('lib/filelib.php');
 
@@ -40,9 +43,6 @@
     $lifetime = $CFG->filelifetime;
 }
 
-// disable moodle specific debug messages
-disable_debugging();
-
 $relativepath  = get_file_argument();
 $forcedownload = optional_param('forcedownload', 0, PARAM_BOOL);
 

filter/algebra/pix.php

@@ -1,19 +1,18 @@
-<?PHP // $Id$
+<?PHP
       // This function fetches math. images from the data directory
       // If not, it obtains the corresponding TeX expression from the cache_tex db table
       // and uses mimeTeX to create the image file
 
-    define('NO_MOODLE_COOKIES', true); // Because it interferes with caching
-
+// disable moodle specific debug messages and any errors in output
+define('NO_DEBUG_DISPLAY', true);
+define('NO_MOODLE_COOKIES', true); // Because it interferes with caching
+
     require_once('../../config.php');
 
     if (!filter_is_enabled('filter/algebra')) {
         print_error('filternotenabled');
     }
 
-    // disable moodle specific debug messages
-    disable_debugging();
-
     require_once($CFG->libdir.'/filelib.php');
     require_once($CFG->dirroot.'/filter/tex/lib.php');
 
@@ -61,4 +60,4 @@
             echo "Please turn on debug mode in site configuration to see more info here.";
         }
     }
-?>
+

filter/tex/pix.php

@@ -1,8 +1,10 @@
-<?PHP // $Id$
+<?PHP
       // This function fetches math. images from the data directory
       // If not, it obtains the corresponding TeX expression from the cache_tex db table
       // and uses mimeTeX to create the image file
 
+// disable moodle specific debug messages and any errors in output
+define('NO_DEBUG_DISPLAY', true);
 define('NO_MOODLE_COOKIES', true); // Because it interferes with caching
 
     require_once('../../config.php');
@@ -11,9 +13,6 @@
         print_error('filternotenabled');
     }
 
-    // disable moodle specific debug messages
-    disable_debugging();
-
     require_once($CFG->libdir.'/filelib.php');
     require_once($CFG->dirroot.'/filter/tex/lib.php');
     require_once($CFG->dirroot.'/filter/tex/latex.php');
@@ -75,4 +74,3 @@
             echo "Please turn on debug mode in site configuration to see more info here.";
         }
     }
-?>

lib/setup.php

@@ -161,6 +161,14 @@
  */
 global $SCRIPT;
 
+// Scripts may request no debug and error messages in output
+// please note it must be defined before including the config.php script
+// and in some cases you also need to set custom default exception handler
+if (!defined('NO_DEBUG_DISPLAY')) {
+    define('NO_DEBUG_DISPLAY', false);
+}
+
+/// wwwroot is mandatory
     if (!isset($CFG->wwwroot)) {
         trigger_error('Fatal: $CFG->wwwroot is not configured! Exiting.');
         die;
@@ -354,27 +362,26 @@
     unset($originaldatabasedebug);
     error_reporting($CFG->debug);
 
-/// find out if PHP cofigured to display warnings
+    // find out if PHP cofigured to display warnings,
+    // this is a security problem because some moodle scripts may
+    // disclose sensitive information 
     if (ini_get_bool('display_errors')) {
         define('WARN_DISPLAY_ERRORS_ENABLED', true);
     }
-/// If we want to display Moodle errors, then try and set PHP errors to match
+    // If we want to display Moodle errors, then try and set PHP errors to match
     if (!isset($CFG->debugdisplay)) {
-        //keep it as is during installation
+        // keep it "as is" during installation
+    } else if (NO_DEBUG_DISPLAY) {
+        // some parts of Moodle cannot display errors and debug at all.
+        @ini_set('display_errors', '0');
+        @ini_set('log_errors', '1');
     } else if (empty($CFG->debugdisplay)) {
         @ini_set('display_errors', '0');
         @ini_set('log_errors', '1');
     } else {
+        // This is very problematic in XHTML strict mode!
         @ini_set('display_errors', '1');
     }
-// Even when users want to see errors in the output,
-// some parts of Moodle cannot display them at all.
-// (Once we are XHTML strict compliant, debugdisplay
-//  _must_ go away).
-    if (defined('MOODLE_SANE_OUTPUT')) {
-        @ini_set('display_errors', '0');
-        @ini_set('log_errors', '1');
-    }
 
 /// detect unsupported upgrade jump as soon as possible - do not change anything, do not use system functions
     if (!empty($CFG->version) and $CFG->version < 2007101509) {
@@ -685,6 +692,6 @@ function stripslashes_deep($value) {
 
     }
 
-/// note: we can not block non utf-8 installatrions here, because empty mysql database
+/// note: we can not block non utf-8 installations here, because empty mysql database
 /// might be converted to utf-8 in admin/index.php during installation
 

lib/setuplib.php

@@ -187,7 +187,7 @@ function default_exception_handler($ex) {
     $info = get_exception_info($ex);
 
     if (debugging('', DEBUG_MINIMAL)) {
-        $logerrmsg = "Default exception handler: ".$info->message.' Debug: '.$info->debuginfo."\n".format_backtrace($info->backtrace);
+        $logerrmsg = "Default exception handler: ".$info->message.' Debug: '.$info->debuginfo."\n".format_backtrace($info->backtrace, true);
         error_log($logerrmsg, 0);
     }
 
@@ -198,7 +198,7 @@ function default_exception_handler($ex) {
             echo $OUTPUT->fatal_error($info->message, $info->moreinfourl, $info->link, $info->backtrace, $info->debuginfo);
         } catch (Exception $out_ex) {
             // default exception handler MUST not throw any exceptions!!
-            // the problem here is we do not know if page already started or not, we only know that somebody messed up in outputlib or theme 
+            // the problem here is we do not know if page already started or not, we only know that somebody messed up in outputlib or theme
             // so we just print at least something instead of "Exception thrown without a stack frame in Unknown on line 0":-(
             echo bootstrap_renderer::early_error_content($info->message, $info->moreinfourl, $info->link, $info->backtrace, $info->debuginfo);
             $outinfo = get_exception_info($out_ex);

lib/weblib.php

@@ -3140,8 +3140,8 @@ function get_docs_url($path) {
  * trigger_error() or error_log(). Using echo or print will break XHTML
  * JS and HTTP headers.
  *
+ * It is also possible to define NO_DEBUG_DISPLAY which redirects the message to error_log.
  *
- * @global object
  * @uses DEBUG_NORMAL
  * @param string $message a message to print
  * @param int $level the level at which this debugging statement should show
@@ -3164,34 +3164,32 @@ function debugging($message = '', $level = DEBUG_NORMAL, $backtrace = null) {
             $backtrace = debug_backtrace();
         }
         $from = format_backtrace($backtrace, CLI_SCRIPT);
-        if ($CFG->debugdisplay || isset($UNITTEST->running)) {
-        	// When the unit tests are running, any call to trigger_error
-        	// is intercepted by the test framework and reported as an exception.
-        	// Therefore, we cannot use trigger_error during unit tests.
-        	// At the same time I do not think we should just discard those messages,
-        	// so displaying them on-screen seems like the only option. (MDL-20398)
+        if (!empty($UNITTEST->running)) {
+            // When the unit tests are running, any call to trigger_error
+            // is intercepted by the test framework and reported as an exception.
+            // Therefore, we cannot use trigger_error during unit tests.
+            // At the same time I do not think we should just discard those messages,
+            // so displaying them on-screen seems like the only option. (MDL-20398)
+            echo '<div class="notifytiny">' . $message . $from . '</div>';
+
+        } else if (NO_DEBUG_DISPLAY) {
+            // script does not want any errors or debugging in output,
+            // we send the info to error log instead
+            error_log('Debugging: ' . $message . $from);
+
+        } else if ($CFG->debugdisplay) {
             if (!defined('DEBUGGING_PRINTED')) {
                 define('DEBUGGING_PRINTED', 1); // indicates we have printed something
             }
             echo '<div class="notifytiny">' . $message . $from . '</div>';
+
         } else {
             trigger_error($message . $from, E_USER_NOTICE);
         }
     }
     return true;
 }
 
-/**
- * Disable debug messages from debugging(), while keeping PHP error reporting level as is.
- *
- * @global object
- */
-function disable_debugging() {
-    global $CFG;
-    $CFG->debug = $CFG->debug | 0x80000000; // switch the sign bit in integer number ;-)
-}
-
-
 /**
  *  Returns string to add a frame attribute, if required
  *

mod/glossary/exportfile.php

@@ -1,11 +1,11 @@
 <?php
 
+// disable moodle specific debug messages and any errors in output
+define('NO_DEBUG_DISPLAY', true);
+
 require_once("../../config.php");
 require_once("lib.php");
 
-// disable moodle specific debug messages
-disable_debugging();
-
 $id = required_param('id', PARAM_INT);      // Course Module ID
 
 $l   = optional_param('l','', PARAM_ALPHANUM);
@@ -42,4 +42,3 @@
 
 send_file($content, $filename, 0, 0, true, true);
 
-?>

pluginfile.php

@@ -24,12 +24,12 @@
  * @license    http://www.gnu.org/copyleft/gpl.html GNU GPL v3 or later
  */
 
+// disable moodle specific debug messages and any errors in output
+define('NO_DEBUG_DISPLAY', true);
+
 require_once('config.php');
 require_once('lib/filelib.php');
 
-// disable moodle specific debug messages
-disable_debugging();
-
 $relativepath = get_file_argument();
 $forcedownload = optional_param('forcedownload', 0, PARAM_BOOL);
 

question/file.php

@@ -1,4 +1,4 @@
-<?php  // $Id$
+<?php
       // This script fetches files from the dataroot/questionattempt directory
       // It is based on the top-level file.php
       //
@@ -8,12 +8,12 @@
       // Syntax:      question/file.php/attemptid/questionid/filename.ext
       // Workaround:  question/file.php?file=/attemptid/questionid/filename.ext
 
+// disable moodle specific debug messages and any errors in output
+define('NO_DEBUG_DISPLAY', true);
+
     require_once('../config.php');
     require_once('../lib/filelib.php');
 
-    // disable moodle specific debug messages
-    disable_debugging();
-
     $relativepath = get_file_argument();
     // force download for any student-submitted files to prevent XSS attacks.
     $forcedownload = 1;
@@ -83,4 +83,4 @@ function question_attempt_not_found() {
         header('HTTP/1.0 404 not found');
         print_error('filenotfound', 'error', $CFG->wwwroot); //this is not displayed on IIS??
     }
-?>
+

rss/file.php

@@ -1,4 +1,4 @@
-<?PHP //$Id$
+<?PHP
     //This file returns the required rss feeds
     //The URL format MUST include:
     //    course: the course id
@@ -13,7 +13,9 @@
     //to correct users. It isn't unbreakable,
     //obviously, but its the best I've thought!!
 
-    define('NO_MOODLE_COOKIES', true); // session not used here
+// disable moodle specific debug messages and any errors in output
+define('NO_DEBUG_DISPLAY', true);
+define('NO_MOODLE_COOKIES', true); // session not used here
 
     require_once('../config.php');
     require_once($CFG->libdir.'/filelib.php');
@@ -24,9 +26,6 @@
     // this is a big one big hack - NO_MOODLE_COOKIES is not compatible with capabilities MDL-7243
     // it should be replaced once we get to codes in urls 
 
-    // disable moodle specific debug messages
-    disable_debugging();
-
     $relativepath = get_file_argument();
 
 
@@ -114,4 +113,4 @@ function rss_not_found() {
         global $lifetime, $filename;
         send_file(rss_geterrorxmlfile(), $filename, $lifetime, false, true);
     }
-?>
+

user/grouppix.php

@@ -1,16 +1,15 @@
-<?php // $Id$
+<?php
       // This function fetches group pictures from the data directory
       // Syntax:   pix.php/groupid/f1.jpg or pix.php/groupid/f2.jpg
       //     OR:   ?file=groupid/f1.jpg or ?file=groupid/f2.jpg
 
-    define('NO_MOODLE_COOKIES', true);                  // session not used here
+// disable moodle specific debug messages and any errors in output
+define('NO_DEBUG_DISPLAY', true);
+define('NO_MOODLE_COOKIES', true);                  // session not used here
 
     require_once('../config.php');
     require_once($CFG->libdir.'/filelib.php');
 
-    // disable moodle specific debug messages
-    disable_debugging();
-
     $relativepath = get_file_argument();
 
     $args = explode('/', trim($relativepath, '/'));
@@ -30,4 +29,3 @@
         header('HTTP/1.0 404 not found');
         print_error('filenotfound', 'error'); //this is not displayed on IIS??
     }
-?>