Well-known SW company violates POLA in latest release?

dalecosp

I filed a brief report with a company that produces a well known piece of software(*):

dalecosp_files_a_PR wrote:
I don't know whether these issues are of concern to your company, but as they broke our site for a short time I thought they might at least be looked at by one of your engineers.

The first issue was at site login; we use a bridge module to login both our main installation and {redacted}, and that is probably the reason we had to modify "includes/functions.php". We had to hard code the path to "functions_navigation.php" on line 39.

The second issue was at logout. This is where I'm not sure what happened or why. We got several debug-type errors printed to browser, and finally a "headers already sent" stop error. Defining SKIP_DS_ERRORS at the top of class_core.php fixed the issue, but it feels like a dirty hack. Is there a setting we need to adjust, or did we find a bug, or is there no explanation that you can think of?

Here's the reply:

Zachery wrote:
In previous versions of {redacted} we were suppressing all warnings, and notices. We're no longer doing that in 4.2.2. You should report, or comment on a report in the bug tracker for 4.2.2 and the issues you ran into, then leave that line in place so the site operates properly.

:eek:

I'm assuming that the phrase "that line in place" refers to this which I put at the top of their core class:

define("SKIP_DS_ERRORS",1);

Am I crazy, or did they actually DO this to us?

(* "You're soaking in it" ...)

traq

@I'm sure it won't cause any harm;

@We see that sort of "error handling" all the time in well-used scripts.

@It's really an accepted solution.

Do you know how hard it is to write code that actually
[indent][font=monospace]Fatal Error: unexpected sentence on line 4; missing error control operator[/font][/indent]

…on the other hand, I'd say it's A Good Thing that they're no longer suppressing their errors and warnings.

dalecosp

traq wrote:
I'd say it's a Good Thing...

Until you install the upgrade and wait 24 hours to find that every login is creating a white stop error page on your "flagship" site.

THAT is the reason I prefer to write everything ... every.thing.from.scratch. It's not that I want to re-invent the wheel ... nobody else makes trustworthy wheels. 😉

laserlight

dalecosp wrote:
THAT is the reason I prefer to write everything ... every.thing.from.scratch. It's not that I want to re-invent the wheel ... nobody else makes trustworthy wheels.

I doubt your wheels are trustworthy :p

bradgrafelman

dalecosp;11036901 wrote:
Until you install the upgrade and wait 24 hours to find that every login is creating a white stop error page on your "flagship" site.

Bigger problem: This wasn't caught when you first deployed the upgrade to your development / sandboxed production replica server(s). :p

dalecosp

production replica server(s)

There ain't one.

Licensing issue, again with a 3rd party. My wheels, please.

laserlight wrote:
I doubt your wheels are trustworthy

I like the way you think! 😃

dalecosp

dalecosp;11036909 wrote:
There ain't one.

I should, perhaps, clarify.

1] They had a "preview" site, intended for such purposes, which is hopelessly out of date and didn't work too well, anyway; located on same server (!) and I don't like that idea....

2] I have a "fake" site, but as the license doesn't work on it, it only has certain parts working (the certain parts I've replaced already, usually; the other "certain parts" I hope to all have replaced some day...)

traq

traq;11036845 wrote:
I'd say it's A Good Thing that they're no longer suppressing their errors and warnings.

dalecosp;11036901 wrote:
Until you install the upgrade and wait 24 hours to find that every login is creating a white stop error page on your "flagship" site.

Well, to clarify, it would have been better if they had fixed all the errors before they stopped suppressing them. Or had never suppressed them in the first place. Let you see what kind of product you're buying upfront.