Ability to disable debugger permanently based on cookie

[Alexander Obuhovich]

Debugger in In-Portal is only enabled, when site visitor's IP address is listed in debug.php file. However this is not enough, when developers are using shared IP (for example during Network Address Translation usage) and one or more of the developers wants to disable debug mode for him only.

Also useful, when managers and developers of company, using In-Portal share the same IP address and managers don't want to be in debug mode at all.

I see this as "Disable Permanently"/"Disable" button in debugger toolbar. Once clicked user will be asked for confirmation and once confirmed there are two options:

• disable debugger for entire domain - useful when multiple sites are developed on same domain (for manager)
  
• disabled for entire site - useful for production sites

Since we will not ask user how what the area of disabling debugger, then only one should be used.

--
Best Regards,

http://www.in-portal.com
http://www.alex-time.com

[Dmitry Andrejev]

This should very clever and useful.

I would call a new button as "Turn OFF".

DA.

[Ilya Bernshteyn]

This will be pretty convenient! 

I'm a little confused with what this means:

• disable debugger for entire domain - useful when multiple sites are developed on same domain (for manager)
• disabled for entire site - useful for production sites

1) Bullet point 1 - in other words, dev.intechnic.com/site - disable for all dev.intechnic.com/sites or www.actual-site.com?

2) Bullet point 2 - how is this different from #2?

Ilya

[Alexander Obuhovich]

Bullet point 1 - disables for dev.intechnic.com/site1 and dev.intechnic.com/site2, even, when only used on dev.intechnic.com/site1
Bullet point 2 - only for current website/subfolder not others on same domain

[Dmitry Andrejev]

Ilya, is it clear now?

Alex, I have gave it a send thought - "Disable Debugger" option will work for everyone I think.

DA.

[Dmitry Andrejev]

Anyone else has questions?

Let's try to finalize this quickly and convert in a new task so it's not lost.

DA.

[Phil -- wbtc.fr --]

"Turn off" button in debugger toolbar seems a good solution, nothing to setup anywhere else.

Should you create a separate cookie called "in-portal_debug", to easily locate and delete it if needed?

2010/4/18 Dmitry Andrejev <dand...@gmail.com>

[Dmitry Andrejev]

Yes, Phil - it will set the cookie.

Alex, ready for a task?

DA.

[Alexander Obuhovich]

ok

[Alexander Obuhovich]

Task created: http://tracker.in-portal.org/view.php?id=708

[Alexander Obuhovich]

Here is the patch. Ready for testing. Cookie is created with 1 year expiration.

[Phil -- wbtc.fr --]

cool. Another question I just though about this morning, because my usual internet connection is lost: could it also be used to permanently activate debug, without any specific IP address?

2011/7/1 Alexander Obuhovich <aik....@gmail.com>

[Alexander Obuhovich]

Then it will be security hole, since everyone who will set that cookie (that will be the same for all users) will be able to see debugger reports, that could disclose some secret information about website internals.

[Phil -- wbtc.fr --]

can't this cookie hold a security key? I've also thought about browser-based security, but it seems harder to recognize, isn't it?

2011/7/1 Alexander Obuhovich <aik....@gmail.com>

[Alexander Obuhovich]

Then we need to store all that keys somewhere, e.g. in new table. This doesn't look too good.

Better to use dyndns service and type your dyndns host instead of ip in debug.php. Then we can add hostname resolving during debug.php processing.

>>>>>>>>>>>>> - disable debugger for entire domain - useful when multiple

>>>>>>>>>>>>> sites are developed on same domain (for manager)

>>>>>>>>>>>>> - disabled for entire site - useful for production sites

>>>>>>>>>>>>>
>>>>>>>>>>>>> 1) Bullet point 1 - in other words, dev.intechnic.com/site -
>>>>>>>>>>>> disable for all dev.intechnic.com/sites or www.actual-site.com?
>>>>>>>>>>>>
>>>>>>>>>>>> 2) Bullet point 2 - how is this different from #2?
>>>>>>>>>>>>
>>>>>>>>>>>> Ilya
>>>>>>>>>>>>
>>>>>>>>>>>>
>>>>>>>>>>>>
>>>>>>>>>>>> On Mon, Apr 12, 2010 at 9:31 PM, Dmitry Andrejev <
>>>>>>>>>>>> dand...@gmail.com> wrote:
>>>>>>>>>>>>
>>>>>>>>>>>>> This should very clever and useful.
>>>>>>>>>>>>>
>>>>>>>>>>>>> I would call a new button as "Turn OFF".
>>>>>>>>>>>>>
>>>>>>>>>>>>>
>>>>>>>>>>>>> DA.
>>>>>>>>>>>>>
>>>>>>>>>>>>>
>>>>>>>>>>>>> On Mon, Apr 12, 2010 at 12:06 PM, Alexander Obuhovich <
>>>>>>>>>>>>> aik....@gmail.com> wrote:
>>>>>>>>>>>>>
>>>>>>>>>>>>>> Debugger in In-Portal is only enabled, when site visitor's IP
>>>>>>>>>>>>>> address is listed in debug.php file. However this is not enough, when
>>>>>>>>>>>>>> developers are using shared IP (for example during Network Address
>>>>>>>>>>>>>> Translation usage) and one or more of the developers wants to disable debug
>>>>>>>>>>>>>> mode for him only.
>>>>>>>>>>>>>>
>>>>>>>>>>>>>> Also useful, when managers and developers of company, using
>>>>>>>>>>>>>> In-Portal share the same IP address and managers don't want to be in debug
>>>>>>>>>>>>>> mode at all.
>>>>>>>>>>>>>>
>>>>>>>>>>>>>> I see this as "Disable Permanently"/"Disable" button in
>>>>>>>>>>>>>> debugger toolbar. Once clicked user will be asked for confirmation and once
>>>>>>>>>>>>>> confirmed there are two options:
>>>>>>>>>>>>>>

>>>>>>>>>>>>>> - disable debugger for entire domain - useful when multiple

>>>>>>>>>>>>>> sites are developed on same domain (for manager)

>>>>>>>>>>>>>> - disabled for entire site - useful for production sites

[Dmitry Andrejev]

Yes, I like Alex's idea with Hostname resolving option!

DA

--

Best regards,

Dmitry A.

[Phil -- wbtc.fr --]

this idea sounds very easy to implement, I like it too :)

2011/7/1 Dmitry Andrejev <dand...@gmail.com>

[Alexander Obuhovich]

Then we need to start new discussion about hostname resolve abilities in debug.php file.

[Dmitry A.]

Hi guys,

I have came across the issue with current implementation of this new functionality when you can Disable Debugger via Cookie setting. Basically, if you are running multiple websites on the same domain it will Disable the Debugger for all site on this domain instead of just the one I have specified. This is happens due to Website Path which is specified when Cookie is set.

By the way, I thought I would continue this discussion so it earlier to find all close related things in one place.

DA

[Dmitry A.]

Any ideas on this?

Alex, Phil?

DA

[Phil -- wbtc.fr --]

when you talk about multiple websites, is it Sitedomain, or separate installs?

If it's different installs, I'd suggest something which is missing, at least to me in daily work: ability to enable/disable debugger from admin, and maybe let IP setup in debug.php.

2011/12/6 Dmitry A. <dand...@gmail.com>

[Alexander Obuhovich]

This enable/disable debugger is only needed when your IP is already in debug.php but you won't want debug mode enabled and changing debug.php isn't an option.

Most usual case is when all computers in office share same IP address, used to access Internet. Then debug mode enabled for one IP resulting it enabled for all computers in office, which maybe not desired effect.

Dmitry is talking about a case, when you have several In-Portal installs on same domain and each install has it subfolder, e.g.:

• http://www.main-website.com/sub-site1/
• http://www.main-website.com/sub-site2/
• http://www.main-website.com/sub-site3/
• .....

Now we have a bug, when you disable debugger for one sub-site, then it is also disabled for other sub-sites as well.

[Phil -- wbtc.fr --]

do you mean that 1 debug.php file interact with other sub-sites, while it"s not in the same system folder?

anyway my proposal about admin setting is still good, as this could store an info in connected user's cookie.

2011/12/6 Alexander Obuhovich <aik....@gmail.com>

[Alexander Obuhovich]

Nope, this is the case, when each of sub-sites have that IP listed in each of them, but cookie to turn off debugger is set to whole domain and not a specific sub-site.