779961 - Information Disclosure due to error reporting on https://developer.mozilla.org/forums/

Status: RESOLVED FIXED

(developer.mozilla.org Graveyard :: General, defect)

Description

[Christian]

Attachment: Bildschirmfoto 2012-08-02 um 21.11.44.png

User Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.7; rv:14.0) Gecko/20100101 Firefox/14.0.1
Build ID: 20120713134347

Steps to reproduce:

If you look at the attached picture, you'll notice that PHPs error reporting is enabled for that instance of phpBB. It occurs when I submit the form that is shown there (https://developer.mozilla.org/forums/ucp.php?mode=login)

Displaying errors like this can be a security risk and should be prevented.

Comment 1

[Daniel Veditz [:dveditz]]

The forums appear to be gone: the link above is 404 and the community "Discussions" menu item in the site's navigation bar takes me to
   https://developer.mozilla.org/en-US/discussions
which says the forums are gone.

The links to browse the archived discussions is also 404. Maybe if that went to the right place the problem would still be present? Probably not because Kuma is written in Django/Python rather than PHP.

Comment 2

[Christian]

I can confirm the content is gone :( It was there yesterday (see attachment)

Comment 3

[Reed Loden [:reed]]

Yeah, Kuma took over as of this morning. https://hacks.mozilla.org/2012/08/introduction-to-kuma-templates-and-scripts/

Comment 5

[Raymond Forbes[:rforbes]]

we stopped using mindtouch for our developer site, well, right after you found this.  :)  there is a new site to attack!

Comment 6

[Luke Crouch [:groovecoder]]

Fixed - by removing phpbb completely! mwuhahaha.

Comment 7

[Will Kahn-Greene [:willkg] ET needinfo? me]

For bugs that are resolved, we remove the security flag. These haven't had their flag removed, so I'm removing it now.