id	summary	reporter	owner	description	type	status	priority	milestone	component	version	severity	resolution	keywords	cc	mlocked
257	Sort of security issue: sensitive data sent outside	daniel.danner@…	xris	"I experienced something with mythweb that might be problematic considering security.

When mythweb runs on any dyndns host (for example 'somemythweb.dnsalias.org'), and this line in conf.php remains unchanged (because it looks like good automagic):
{{{
define('error_email', 'mythweb_errors@'.preg_replace('/.*?\b([\w\-]+\.[\w\-
]+)$/', '$1', server_domain));
}}}
...mythweb will send every PHP error report to mythweb_errors@dnsalias.org, which potentially enables complete stranges to read the report. This doesn't sound ''that'' evil at first, but I noticed the following lines in such reports:
{{{
[PHP_AUTH_USER] => someuser
[PHP_AUTH_PW] => somepasswd
}}}

So if one's mythweb runs on a public server protected by some simple mod_auth, and he doesn't look ''very'' carefully at his conf.php, his login data could potentially be sent anywhere.

I was just thinking, you might want to change this default behaviour to something like error_email=mythweb_errors@localhost..."	defect	closed	minor	unknown	mythweb		medium	wontfix			0