Re: [RFC] [Discussion] Change default for zend.exception_ignore_args INI setting

From: Date: Thu, 10 Apr 2025 19:10:40 +0000
Subject: Re: [RFC] [Discussion] Change default for zend.exception_ignore_args INI setting
References: 1 2 3  Groups: php.internals 
Request: Send a blank email to [email protected] to get a copy of this message 
On Thu, Apr 10, 2025, at 1:53 PM, Bob Weinand wrote:

>> I'd rather see the value in php.ini-production being changed to 
>> Off to match the built-in default. see 
>> https://github.com/php/php-src/pull/18215#issuecomment-2768618516
>
>
> Full agreement with Tim here - make PHP friendly to development.
>
> There are only few places where secrets would be actually relevant, and 
> those can be covered by #[SensitiveParameter].

I tend to agree as well.  #[SensitiveParameter] is the better solution in the 95% case.  If there
are libraries still not using it (as the RFC suggests), those should have bugs (or preferably
patches) filed against them.

The great thing about attributes is they're intrinsically backward compatible, so there's
no meaningful cost to adding/patching liberally.

--Larry Garfield

Thread (12 messages)

« previous php.internals (#127089) next »