Take the 2-minute tour ×
Craft CMS Stack Exchange is a question and answer site for administrators, end users, developers and designers for Craft CMS. It's 100% free, no registration required.

DevMode is awesome, but I wanted to post this as a bit of a heads up.

I'll preface to say yes, you shouldn't be developing live and yes, the docs do include a warning(yet very small and not really explaining why).

But I am assuming alot of you have it turned on right now.

It reveals the craft path, file system paths, plugins installed, field handles and a whole lot of other juicy stuff.

To everyone.

Couldn't we have, or is there a way to have, this wonderful feature only available if logged in and/or admin?

share|improve this question

closed as off-topic by carlcs, Brandon Kelly, Anna_MediaGirl Aug 22 at 16:12

This question appears to be off-topic. The users who voted to close gave this specific reason:

  • "Feature requests for Craft CMS or plugins are off-topic as the community can't be expected to provide answers. Instead, please submit feature requests directly to the vendor of the product being used." – carlcs, Brandon Kelly, Anna_MediaGirl
If this question can be reworded to fit the rules in the help center, please edit the question.

    
I mean the warning on the General Config page of the the docs. The caution tape is clear, but if I did not understand the ramifications when I initially implemented it, it means nothing. The warning in the docs gets lost. It's the only one on the page and styled as another variable. It probably should be big/red with a direct link to the "What does Dev Mode do?" But then that page makes an assumption that the reader should know that this stuff is available to all users... not just Admin. Coming from "cough" EE, turning on debugging did not reveal this stuff unless I was logged in. –  AbbeyDesign Aug 22 at 13:14
1  
Craft is not a new version of EE. It's doing things differently, so you can't simply assume that dev mode is available to admin users only. –  carlcs Aug 22 at 13:38
    
You don't say. All I am saying is alot of the developers using craft, are/where EE developers. Yeah, I assumed wrong, I should have known better, but the docs are not clear. @carlcs –  AbbeyDesign Aug 22 at 13:52

3 Answers 3

Making it only available to logged in users and/or admin, would make it impossible to debug the site as an anonymous user would see it. I'd say that's an pretty important feature which I think is wrong to remove just because someone might configure craft wrong.

But maybe it'd be possible to use a plugin to turn on/off devMode depending on user permissions?

share|improve this answer

There already was a warning about it, but it didn’t really stick out, I guess.

Just gave it the actual Warning style treatment, so hopefully this helps the next guy:

share|improve this answer
    
Thanks! @brandon-kelly That will certainly help the next guy. I'd also humbly suggest to update the "What does Dev Mode do" page to actually spell out that the information is available if not logged in. Something like "As you can probably tell, Dev Mode is definitely not suited for production environments as it reveals sensitive data to both logged in and anonymous users" with that fancy red exclamation point. –  AbbeyDesign Aug 22 at 15:07
    
If that weren’t the case, I don’t know why we would be trying to warn against it at all. Nobody would mind if all that stuff was only revealed to admins. –  Brandon Kelly Aug 22 at 15:23
    
I get that, and that page does a great deal of explaining what devmode does other than that one tiny detail. Again, coming from "coughing again" EE, one could easily make a wrong assumption. –  AbbeyDesign Aug 22 at 15:44

Why don't you set up a second, password protected environment (.htaccess restrictions) and enable dev mode only for that environment:

return array(

    'example.com' => array(
    ),

    'dev.example.com' => array(
        'devMode' => true,
    ),

);
share|improve this answer

Not the answer you're looking for? Browse other questions tagged or ask your own question.