• Resolved Backpack.Studio

    (@backpackstudio)


    When WP_DEBUG is true, the plugin runs:

    ini_set('display_errors', 0);
    ini_set('log_errors', 1);
    ini_set('error_log', WP_CONTENT_DIR . '/debug.log');

    This ignores a custom WP_DEBUG_LOG path. WordPress documents that constant as either true or a file path. Core wp_debug_mode() honours the path. TranslatePress then overwrites it.

    wp-content/debug.log is inside the web root. Unless the server blocks it, the PHP error log is publicly downloadable. That is a security issue: the file often contains paths, plugin versions, and request data.

    The method only needs display_errors off so notices are not stored as translation strings. It does not need to change error_log.

    Do not call ini_set('error_log', …) at all, or use WP_DEBUG_LOG when it is a non-empty string:

    if ( defined( 'WP_DEBUG_LOG' ) && is_string( WP_DEBUG_LOG ) && WP_DEBUG_LOG !== '' ) {
    ini_set( 'error_log', WP_DEBUG_LOG );
    }
Viewing 1 replies (of 1 total)
  • Plugin Support Daniel

    (@danieldandu)

    Hello @backpackstudio

    Thank you for bringing this to our attention.

    We’ve forwarded this to our development team, and a fix will be included in an upcoming update.

    We appreciate you taking the time to report this and provide the relevant details.

Viewing 1 replies (of 1 total)

You must be logged in to reply to this topic.