I wrote a small website in PHP and ZF2.

Had a friend test it out by posting a link to it on Facebook.

Apparently I forgot to turn off ZendFramework reporting and he find an error. Posted a photo of the error.

In the photo it is exposed that I'm using ZF2 and my account's username, and paths to error exposing ZF2 file location.

/home/user/public_html, things like that


An error occurred
Additional information:
Unable to send mail: 
Stack trace:
#0 [internal function]: Zend\Mail\Transport\Sendmail->mailHandler('mail <mail@mail...', 'Your ...', 'Your Commission...', 'Date: Sat, 21 M...', ' -fservice@mail...')
#1 /home/username/public_html/domain.net/vendor/zendframework/zend-mail/src/Transport/Sendmail.php(138): call_user_func(Array, 'mail <mail@mail...', 'Your ...', 'Your Commission...', 'Date: Sat, 21 M...', ' -fservice@mail...')
#2 /home/username/public_html/domain.net/module/Commission/src/Mail/Mail.php(22): Zend\Mail\Transport\Sendmail->send(Object(Zend\Mail\Message))

(username and domain and emails in message above are altered)

Is the text on the photo endangering my security?

Do I ask him to take it down?

  • If I can improve this question pls let me know
    – dennismv
    May 21, 2016 at 15:21
  • 2
    It would help to know exactly what was in that image. Since the image is already on Facebook, you won't make things worse by posting it here. May 21, 2016 at 17:49
  • I have now posted altered but otherwise intact example. Thanks.
    – dennismv
    May 21, 2016 at 22:22

2 Answers 2


You shouldn't show exceptions to users, and it does have a slight impact on security.

I'm assuming that you disabled exceptions, and are now worried about the data that is leaked via the screenshot:

Leaked Username

Usernames aren't generally considered sensitive information.

You may still want to keep it secret as defense in depth, to make some attacks such as bruteforce, phishing, or privilege escalation more difficult, but leaking a username is generally not considered a security issue.

Leaked absolute Paths

Full Path Disclosure may:

  • aid in the exploitation of LFI vulnerabilities. [Although an attacker may be able to exploit LFI without knowing the absolute path, or may guess the correct path themselves.]
  • provide information about the operating system. [This may help in discovering further vulnerabilities, or may aid in the exploitation of other existing vulnerabilities.]
  • leak system usernames. [see above.]
  • leak names of secret public directories and thus lead to disclosure of sensitive information. [although you shouldn't rely on the secrecy of a publicly accessibly directory to protect you; security through obscurity shouldn't be your main line of defense.]


On it's own, it is very unlikely that the leaked information can be used to start an attack. However, it may make other existing vulnerabilities slightly easier to exploit or aid in finding further vulnerabilities.

It is generally preferred to keep this information private, so you may want to change your username as well as the paths, but if it is not easily doable, the security of your server will not be severely impacted if you don't.

  • thanks. Just to note that I posted an example (exact but altered) as to what the info looks like
    – dennismv
    May 21, 2016 at 22:24
  • And yes. You got my concern exactly right
    – dennismv
    May 21, 2016 at 22:40

Generally, those errors are really useful when an attacker is trying to compromise the site. In your case it isn't something fancy, the only attack vector I see is brute-force/dictionary attack, since the error exposed your username.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.