@DenisChenu, have you ever seen an exposure like this before?

Hmm, from looking at the code I don't think anyone except superadmin can see this info

Screenshot 2024-06-13 at 16.56.33.png (51,403 bytes)   

Screenshot 2024-06-13 at 16.56.33.png (51,403 bytes)   

I don't see it on your screenhost : too little.
ENV parameters ?
We can not know if we allow it or not. Else : except restriction to ForcedSuperAdmin (user 1 by default) no reason to enforce more.

The fix are not so old about restriction, maybe forcedsuperadmin only ?

@DenisChenu I don't understand what you wrote, sorry.
Afaik there are no restrictions what is shown via phpinfo. So there could be some ENV vars that are unwillingly exposed this way, but I would say this is the issue of setting them improperly. Or am I seeing this wrong?

@DenisChenu I don't understand what you wrote, sorry.

You mean about ForcedSuperAdmin ? I mean : by defult : user #1 have access to all since he have access to FTP and DB parameters. Simple super admin didn't have access to all. Then maybe restriction to forced super admin

reference
https://github.com/LimeSurvey/LimeSurvey/blob/f529dfb14c5ec2d05864614bc9ec0c7db1eefb20/application/models/Permission.php#L637
https://github.com/LimeSurvey/LimeSurvey/blob/f529dfb14c5ec2d05864614bc9ec0c7db1eefb20/application/config/config-defaults.php#L673
https://github.com/LimeSurvey/LimeSurvey/pull/3801

but I would say this is the issue of setting them improperly. Or am I seeing this wrong?

:+1:

Looks like only superadmins can access this.

And it surely is a thing of setting ENV variables (wrong) and then these can get exposed.
Question is if we have any chance to filter such an exposure?

Question is if we have any chance to filter such an exposure?

Clearly not,

1. Unsure this can be done ( remove ENV)
2. You can want to know if some ENV are set (for example : production/prepro etc …)

As I see it, this is not an issue on the application side -> closing this issue.

@tibor.pacalat: Can you remove the screenshot I attached and make this public?

Done