stack trace display only to moderators

[Migrated From Jforum.net]

Wouldn't it be simpler just to keep stacktraces in the logs? I mean, for development it's ok to see immediatly the stack trace but for a final product like this one, unless the moderators are Java programmers, I don't think it is necessary to show them the full error message.

Just good old logging and a neutral message like "there was a problem yadda yadda, notify your admin". You could even make it so an unhandled message sent an email to the forum admin with the stack trace and all the parameters.


[originally posted on jforum.net by GreenEyed]

[Migrated From Jforum.net]

Hi all,

Our security department recommended to display stack trace only to moderators, so hackers cannot get clue about system (I know it is open source and they can make it if they look at the source, but this is still good practice).

Therefore I've made a small modification to the file below. This file displays stack trace only to moderators. Date and time of the error is also appended to aid moderators find the stack trace of the exceptions users get, in the forum log file.

14.12.05: Deleted java file, see below for the new version. This one was downloaded 17 times.
[originally posted on jforum.net by cagin]

[Migrated From Jforum.net]

I agree, but I just didn't want to change things that much. Others may still find it useful to see the exception right in front of them burried in source of the html, rather than to dive into the logs.
[originally posted on jforum.net by cagin]

[Migrated From Jforum.net]

Ok, I will include it in the main distribution, but make it confiurable - allowing by default the current behaviour.

Rafael
[originally posted on jforum.net by Rafael Steil]

[Migrated From Jforum.net]

OK, I made it optional. If jforum-cust.conf includes

exceptions.to.moderatorsOnly=true

then only moderators see stack trace.

Deleted previous file.

Have fun
[originally posted on jforum.net by cagin]