Since upgrading to 3.8.1 I am unable to turn off debug mode in my dev environment. I read the post about the new requirement for debugPassword reinitPassword and I made sure to set those in my test environment settings:
And I restarted the Railo engine to make sure those changes were picked up. I also tried setting these values to empty strings in my production settings.
In all cases, when I load debugmode=false, the debug goes away for a single request, then comes back on the next request.
Any ideas? Not a huge deal, but I like to be able to shut it off occasionally.
I’m looking at the DebuggerService and I’m wondering if it has to do with the cookies set in setDebugMode(). Around lines 174:
First off, not sure why turning debug on uses getCookieName() vs. instance.cookieName when turning off. Secondly, when you are turning debug off, it also expires the cookie immediately, which I think is the problem. Once the cookie is gone, the framework goes back to the coldbox.debugMode setting. I think you want to just set the value of the cookie to disabled, but not expire it.
Yeah, it’s a combination of that cookie being removed and the change to getDebugMode() made in Brad’s commit here:
getDebugMode() used to always return false when the cookie did not exist. Now it returns the debugMode setting. I understand why, but the cookie needs to not expire when disabling to support this.
This was just an oversight in our recent security enhancements to debug mode. I tested using the URL params to turn ON debug mode when the master setting was off, but must not have tested the other way around.
