Php – Disable PHP stack traces in Apache logs

apache-2.4PHPSecurity

I've run across an in-house PHP application which occasionally crashes during user authentication and dumps a stacktrace into /var/log/apache2/. Problem is it logs the username and pass in cleartext.

PHP Fatal error...Stack trace:...ldapauthenticated('bobuser', 'secrit123')...

I've run across a few mentions on various stack* forums about disabling the stack traces in .htaccess or with a line of code in the PHP app itself however there seem to be varying degrees of success with these methods and I'd rather just disable the lot of it site-wide instead of editing a jazillion PHP code files.

I thought I'd poke around in /etc/php/ for an obvious setting somehow but there are myriad files and several directories there (7.0/ir, 7.0/cli, 7.0/cli/conf.d, 7.0/apache2/conf.d/,...) and no idea which file takes precedence over the other. I did find a log_errors setting which looked promising in 7.0/apache2/php.ini however the comment there says the default is off. Obviously either not working or the wrong config item.

Anyone know of a way to disable PHP stacktraces site wide?

Best Answer

try

zend.exception_ignore_args = On

in /etc/php/7.0/apache2/php.ini

Related Topic