Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

stop /error/report.php from processing empty reports #1581

Closed
ulbiopro opened this issue Apr 30, 2021 · 5 comments
Closed

stop /error/report.php from processing empty reports #1581

ulbiopro opened this issue Apr 30, 2021 · 5 comments

Comments

@ulbiopro
Copy link

ulbiopro commented Apr 30, 2021

A simple GET request on {BASE_URL}/errors/report.php will trigger processor.php to process an empty report. In case you set up an email report action, you get notified with empty "Store Debug Information" E-Mails.

Description (*)

Turn off the notification for empty messages. Or even better, if possible, deny webaccess on report.php and processor.php.

Benefits

Less junk? ;-)

Additional information

My question would be following:
Is it possible to suppress empty messages or could this cause trouble?

Like:

$subject = sprintf('%s [%s]', (string)$this->_config->subject, $this->reportId);
@mail((string)$this->_config->email_address, $subject, $msg);

            if(!is_null($this->reportData)) {
                $subject = sprintf('%s [%s]', (string)$this->_config->subject, $this->reportId);
                @mail((string)$this->_config->email_address, $subject, $msg);
            }
@fballiano
Copy link
Contributor

fballiano commented Apr 30, 2021

Hi @ulbiopro, I tried to create PR #1588 for this issue.

Flyingmana pushed a commit that referenced this issue May 28, 2021
This should improve #1581

If checks that parameter $_GET['id'] is passed (it's then casted to int by processor.php) but ONLY if the report.php script is called directly.
This first part of the check is necessary because report.php is included in Mage::printException()
@fballiano
Copy link
Contributor

@ulbiopro my PR was merged, can you please close the issue?

@addison74
Copy link
Contributor

@fballiano - My opinion that if such requests are not answered they should be closed by those who manage the project after a week. There are a lot of hangers who have no feedback from those who have them initially and we must strive for a reduction in the number for visibility and obviously for trust. When we see a limited number of issues we have a feeling that things are still moving forward.

@fballiano
Copy link
Contributor

I totally agree but that doesn't happen, that's why I try tagging the original author

@ulbiopro
Copy link
Author

ulbiopro commented Aug 2, 2021

Sorry for the late response. I had an longer ongoing vacation.

@ulbiopro ulbiopro closed this as completed Aug 2, 2021
randallelliott714 added a commit to randallelliott714/magento that referenced this issue Oct 18, 2022
This should improve OpenMage/magento-lts#1581

If checks that parameter $_GET['id'] is passed (it's then casted to int by processor.php) but ONLY if the report.php script is called directly.
This first part of the check is necessary because report.php is included in Mage::printException()
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Projects
None yet
Development

No branches or pull requests

3 participants