class ErrorReporting in Security Review 8

Defines a security check that checks the error reporting setting.

Hierarchy

• class \Drupal\security_review\Check uses DependencySerializationTrait, StringTranslationTrait
  • class \Drupal\security_review\Checks\ErrorReporting

1 file declares its use of ErrorReporting

security_review.module in ./security_review.module

Site security review and reporting Drupal module.

File

src/Checks/ErrorReporting.php, line 12

Namespace

Drupal\security_review\Checks

class ErrorReporting extends Check {

  /**
   * {@inheritdoc}
   */
  public function getNamespace() {
    return 'Security Review';
  }

  /**
   * {@inheritdoc}
   */
  public function getTitle() {
    return 'Error reporting';
  }

  /**
   * {@inheritdoc}
   */
  public function run() {

    // Get the error level.
    $error_level = $this
      ->configFactory()
      ->get('system.logging')
      ->get('error_level');

    // Determine the result.
    if (is_null($error_level) || $error_level != 'hide') {
      $result = CheckResult::FAIL;
    }
    else {
      $result = CheckResult::SUCCESS;
    }
    return $this
      ->createResult($result, [
      'level' => $error_level,
    ]);
  }

  /**
   * {@inheritdoc}
   */
  public function help() {
    $paragraphs = [];
    $paragraphs[] = $this
      ->t('As a form of hardening your site you should avoid information disclosure. Drupal by default prints errors to the screen and writes them to the log. Error messages disclose the full path to the file where the error occurred.');
    return [
      '#theme' => 'check_help',
      '#title' => $this
        ->t('Error reporting'),
      '#paragraphs' => $paragraphs,
    ];
  }

  /**
   * {@inheritdoc}
   */
  public function evaluate(CheckResult $result) {
    if ($result
      ->result() == CheckResult::SUCCESS) {
      return [];
    }
    $paragraphs = [];
    $paragraphs[] = $this
      ->t('You have error reporting set to both the screen and the log.');
    $paragraphs[] = Link::createFromRoute($this
      ->t('Alter error reporting settings.'), 'system.logging_settings');
    return [
      '#theme' => 'check_evaluation',
      '#paragraphs' => $paragraphs,
      '#items' => [],
    ];
  }

  /**
   * {@inheritdoc}
   */
  public function evaluatePlain(CheckResult $result) {
    if ($result
      ->result() == CheckResult::SUCCESS) {
      return '';
    }
    if (isset($result
      ->findings()['level'])) {
      return $this
        ->t('Error level: @level', [
        '@level' => $result
          ->findings()['level'],
      ]);
    }
    return '';
  }

  /**
   * {@inheritdoc}
   */
  public function getMessage($result_const) {
    switch ($result_const) {
      case CheckResult::SUCCESS:
        return $this
          ->t('Error reporting set to log only.');
      case CheckResult::FAIL:
        return $this
          ->t('Errors are written to the screen.');
      default:
        return $this
          ->t('Unexpected result.');
    }
  }

}

Members

Name	Modifiers	Type	Description	Overrides
Check::$config	protected	property	The configuration storage for this check.
Check::$container	protected	property	The service container.
Check::$settings	protected	property	Settings handler for this check.
Check::$state	protected	property	The State system.
Check::$statePrefix	protected	property	The check's prefix in the State system.
Check::checklist	protected	function	Returns the Security Review Checklist service.
Check::configFactory	protected	function	Returns the Config factory.
Check::container	protected	function	Returns the service container.
Check::createResult	public	function	Creates a new CheckResult for this Check.
Check::currentUser	protected	function	Returns the current Drupal user.
Check::database	protected	function	Returns the database connection.
Check::enable	public	function	Enables the check. Has no effect if the check was not skipped.
Check::entityTypeManager	protected	function	Returns the entity type manager.
Check::getMachineNamespace	public	function	Returns the namespace of the check.
Check::getMachineTitle	public	function	Returns the machine name of the check.	5
Check::id	final public	function	Returns the identifier constructed using the namespace and title values.
Check::isSkipped	public	function	Returns whether the check is skipped. Checks are not skipped by default.
Check::kernel	protected	function	Returns the Drupal Kernel.
Check::lastResult	public	function	Returns the last stored result of the check.
Check::lastRun	public	function	Returns the timestamp the check was last run.
Check::moduleHandler	protected	function	Returns the module handler.
Check::runCli	public	function	Same as run(), but used in CLI context such as Drush.	2
Check::security	protected	function	Returns the Security Review Security service.
Check::securityReview	protected	function	Returns the Security Review service.
Check::settings	public	function	Returns the check-specific settings' handler.
Check::skip	public	function	Marks the check as skipped.
Check::skippedBy	public	function	Returns the user the check was skipped by.
Check::skippedOn	public	function	Returns the timestamp the check was last skipped on.
Check::storeResult	public	function	Stores a result in the state system.
Check::storesFindings	public	function	Returns whether the findings should be stored or reproduced when needed.	2
Check::__construct	public	function	Initializes the configuration storage and the settings handler.	2
DependencySerializationTrait::$_entityStorages	protected	property	An array of entity type IDs keyed by the property name of their storages.
DependencySerializationTrait::$_serviceIds	protected	property	An array of service IDs keyed by property name used for serialization.
DependencySerializationTrait::__sleep	public	function		1
DependencySerializationTrait::__wakeup	public	function		2
ErrorReporting::evaluate	public	function	Returns the evaluation page of a result. Overrides Check::evaluate
ErrorReporting::evaluatePlain	public	function	Evaluates a CheckResult and returns a plaintext output. Overrides Check::evaluatePlain
ErrorReporting::getMessage	public	function	Converts a result integer to a human-readable result message. Overrides Check::getMessage
ErrorReporting::getNamespace	public	function	Returns the namespace of the check. Overrides Check::getNamespace
ErrorReporting::getTitle	public	function	Returns the human-readable title of the check. Overrides Check::getTitle
ErrorReporting::help	public	function	Returns the check-specific help page. Overrides Check::help
ErrorReporting::run	public	function	The actual procedure of carrying out the check. Overrides Check::run
StringTranslationTrait::$stringTranslation	protected	property	The string translation service.	1
StringTranslationTrait::formatPlural	protected	function	Formats a string containing a count of items.
StringTranslationTrait::getNumberOfPlurals	protected	function	Returns the number of plurals supported by a given language.
StringTranslationTrait::getStringTranslation	protected	function	Gets the string translation service.
StringTranslationTrait::setStringTranslation	public	function	Sets the string translation service to use.	2
StringTranslationTrait::t	protected	function	Translates a string to the current language or to a given language.