Please strip PHP_AUTH_PW from $_SERVER environment
Closed this issue · 1 comments
pcheese commented
In ExceptionalEnvironment::to_array you remove some keys and values from the $_SERVER . Please add PHP_AUTH_PW to the list of keys that are stripped to prevent HTTP Auth passwords from being sent to Exceptional. http://php.net/manual/en/features.http-auth.php
ankane commented
Definitely a good idea. Thanks.