Ditto 2.0 New Debug Interface

Just wanted to let the team get a first look at this new feature and make sure the debug code is safe. This is the first time I’ve done anything with sending headers so a code and security review of the debug class would be awesome.

This is not in SVN yet as I’m not sure how secure the debugging component is.

Hi Mark,

the link urls are wrong

h**p://fm.local/~fredm/test/~fredm/test/index.php?id=1&dbg_dump=true

it should be

h**p://fm.local/~fredm/test/index.php?id=1&dbg_dump=true

and I cannot open the debug console (the link is unclickable, tested with Safari and Camino)


:-)

EDIT:
I’ve fixed by changing in lang file

$_lang[’ditto_debug_link’] added javascript: before window.open
and

removed in "[+save_url+]" [+open_url+]=> substr($modx->config[’site_url’],0,-1). debug class

That’s a very nice debug mode Mark

Congrats

Great work on that debugging interface indeed Mark. Now you can have a quick "save source" session and boatloads of info for digging in and figuring stuff out.

Not only is it great for debugging but also better understanding of the inner workings of Ditto

Ok, fixed the issues you discovered heliotrope. Thanks!

Can anyone speak to the security of the method I’m using to send the debug output to the visitor?

Awesome debug view Mark, it makes configuring and understanding the changes in the new version much more clear. I’m hoping to do something like this for my FeedX snippet; I’ll take a look at your code and let you know if I see anything that looks like a potential security vulnerability.

Thanks!

Just a thought, you could make the debug mode dependent on a manager session being present I suppose...

I think that makes sense. Plus, if anyone wants to show someone debug output that is not a registered manager user, they can just send them the debug file. Anyone disagree?

It looks like the only possible security risk would lie in the MODx tab where potentially sensitive snippet calls would be exposed plain text. I think limiting to managers is probably a good idea, especially with the save debug console link.