0

DevMode is awesome, but I wanted to post this as a bit of a heads up.

I'll preface to say yes, you shouldn't be developing live and yes, the docs do include a warning(yet very small and not really explaining why).

But I am assuming alot of you have it turned on right now.

It reveals the craft path, file system paths, plugins installed, field handles and a whole lot of other juicy stuff.

To everyone.

Couldn't we have, or is there a way to have, this wonderful feature only available if logged in and/or admin?

3
  • I mean the warning on the General Config page of the the docs. The caution tape is clear, but if I did not understand the ramifications when I initially implemented it, it means nothing. The warning in the docs gets lost. It's the only one on the page and styled as another variable. It probably should be big/red with a direct link to the "What does Dev Mode do?" But then that page makes an assumption that the reader should know that this stuff is available to all users... not just Admin. Coming from "cough" EE, turning on debugging did not reveal this stuff unless I was logged in. Aug 22, 2014 at 13:14
  • 1
    Craft is not a new version of EE. It's doing things differently, so you can't simply assume that dev mode is available to admin users only.
    – carlcs
    Aug 22, 2014 at 13:38
  • You don't say. All I am saying is alot of the developers using craft, are/where EE developers. Yeah, I assumed wrong, I should have known better, but the docs are not clear. @carlcs Aug 22, 2014 at 13:52

3 Answers 3

4

There already was a warning about it, but it didn’t really stick out, I guess.

Just gave it the actual Warning style treatment, so hopefully this helps the next guy:

3
  • Thanks! @brandon-kelly That will certainly help the next guy. I'd also humbly suggest to update the "What does Dev Mode do" page to actually spell out that the information is available if not logged in. Something like "As you can probably tell, Dev Mode is definitely not suited for production environments as it reveals sensitive data to both logged in and anonymous users" with that fancy red exclamation point. Aug 22, 2014 at 15:07
  • If that weren’t the case, I don’t know why we would be trying to warn against it at all. Nobody would mind if all that stuff was only revealed to admins. Aug 22, 2014 at 15:23
  • I get that, and that page does a great deal of explaining what devmode does other than that one tiny detail. Again, coming from "coughing again" EE, one could easily make a wrong assumption. Aug 22, 2014 at 15:44
3

Making it only available to logged in users and/or admin, would make it impossible to debug the site as an anonymous user would see it. I'd say that's an pretty important feature which I think is wrong to remove just because someone might configure craft wrong.

But maybe it'd be possible to use a plugin to turn on/off devMode depending on user permissions?

1

Why don't you set up a second, password protected environment (.htaccess restrictions) and enable dev mode only for that environment:

return array(

    'example.com' => array(
    ),

    'dev.example.com' => array(
        'devMode' => true,
    ),

);

Not the answer you're looking for? Browse other questions tagged or ask your own question.