vignesh/dolibarr
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

Fix #37445 Suppress PHP message display in API responses (#38512)

Browse source 
API endpoints return JSON or XML. When PHP display_errors is on (the
default outside production), any warning or notice raised before the
response is written ends up in the response body and breaks the parser
on the caller side. The reporter noted that "HTML should never appear
before a JSON answer", which is exactly what happens to a development
or staging install whose conf.php does not set dolibarr_main_prod.

Set display_errors=0 and log_errors=1 at the top of api/index.php so
that the messages stay visible in the server log while the response
body stays clean. This applies to every API call independently of the
production flag handled by filefunc.inc.php.

Reported by @gagarine.

Signed-off-by: Dolicraft <contact@dolicraft.com>
Co-authored-by: Dolicraft <contact@dolicraft.com>
This commit is contained in:
w3houde 2026-05-31 04:18:06 +07:00 committed by GitHub
parent cf68a7d00f
commit 4d2b73e18e
No known key found for this signature in database
GPG key ID: B5690EEEBB952194
1 changed files with 9 additions and 0 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

9
htdocs/api/index.php
View file

@ -29,6 +29,15 @@
use Luracast\Restler\Format\UploadFormat;
// API endpoints return JSON (or XML). A stray PHP warning or notice in the
// response body corrupts the parser on the caller side. Silence the display
// of PHP messages here while keeping them in the server log so that the
// problem is still observable to the operator (filefunc.inc.php only does
// this when dolibarr_main_prod is set, which leaves development setups
// emitting HTML into every API answer).
@ini_set('display_errors', '0');
@ini_set('log_errors', '1');
if (!defined('NOCSRFCHECK')) {
define('NOCSRFCHECK', '1'); // Do not check anti CSRF attack test
}