LotusGuild/tinker_tickets
4
0
Fork 0
Code Issues 46 Pull Requests Actions Packages Projects Releases Wiki Activity

13 of 33 API endpoints never disable display_errors — potential stack-trace leak #39

New Issue
Open
opened 2026-08-31 21:29:45 -04:00 by jared · 0 comments
jared commented 2026-08-31 21:29:45 -04:00
Owner
Copy Link
Copy Source

Severity: Medium

The following endpoints never call ini_set('display_errors', 0), relying entirely on the server's global php.ini setting: api/assign_ticket.php, api/audit_log.php, api/bulk_operation.php, api/check_duplicates.php, api/download_attachment.php, api/get_comments.php, api/get_template.php, api/get_users.php, api/health.php, api/notifications.php, api/saved_filters.php, api/user_preferences.php, api/watch_ticket.php.

The other 20 endpoints explicitly disable it. An uncaught error/warning in one of these 13 (e.g. a DB connection hiccup before any try/catch is entered) can leak a stack trace with internal file paths straight into the JSON/HTML response if the server's display_errors ini default is ever On.

Fix: Add ini_set('display_errors', 0); error_reporting(E_ALL); to the top of these 13 files, matching the pattern used everywhere else — or better, centralize this in a bootstrap include (see the related ErrorHandler.php rollout issue) so it can't be missed on new endpoints.

**Severity:** Medium The following endpoints never call `ini_set('display_errors', 0)`, relying entirely on the server's global `php.ini` setting: `api/assign_ticket.php`, `api/audit_log.php`, `api/bulk_operation.php`, `api/check_duplicates.php`, `api/download_attachment.php`, `api/get_comments.php`, `api/get_template.php`, `api/get_users.php`, `api/health.php`, `api/notifications.php`, `api/saved_filters.php`, `api/user_preferences.php`, `api/watch_ticket.php`. The other 20 endpoints explicitly disable it. An uncaught error/warning in one of these 13 (e.g. a DB connection hiccup before any try/catch is entered) can leak a stack trace with internal file paths straight into the JSON/HTML response if the server's `display_errors` ini default is ever `On`. **Fix:** Add `ini_set('display_errors', 0); error_reporting(E_ALL);` to the top of these 13 files, matching the pattern used everywhere else — or better, centralize this in a bootstrap include (see the related ErrorHandler.php rollout issue) so it can't be missed on new endpoints.
jared added the priority/mediumsecurity labels 2026-09-08 10:15:44 -04:00
Sign in to join this conversation.
No Branch/Tag Specified
Branches Tags
Labels
Clear labels
api
Bearer/internal API surface
 bug
Something is not working
 concurrency
Race condition / concurrency bug
 config
Configuration / deployment default
 data-integrity
Data correctness / schema / integrity issue
 dead-code
Unused / dead code cleanup
 documentation
README / docs accuracy
 duplicate
This issue or pull request already exists
 enhancement
New feature
 help wanted
Need some help
 invalid
Something is wrong
 needs-decision
Needs a maintainer decision, not clearly a bug
 notifications
Matrix / in-app notification bug
 performance
Performance or resource-usage concern
 priority/docs
Documentation-only gap
 priority/high
High-severity / high-impact issue
 priority/low
Low-severity / cosmetic issue
 priority/medium
Medium-severity issue
 question
More information is needed
 rate-limiting
Rate limiting behavior
 reliability
Reliability / error-handling gap
 security
Security or access-control impact
 ux
User-facing UX/functional bug
 wontfix
This won't be fixed
 workflow
Ticket status workflow engine
No labels priority/medium security
Milestone
No items
No Milestone
Projects
Clear projects
No projects
Assignees
Clear assignees
cole (Cole Keller) jared (Jared Vititoe) nathan (Nathan Vititoe)
No Assignees
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: LotusGuild/tinker_tickets#39