In my prod environment, I enabled debugmode for a moment (password required), then in the debug panel, I clicked “Turn debugger off”. It sent me to the url http://myapp/?debugmode=false, but did not actually turn off debug mode. I had to modify the URL and add my debug password to turn it off.
Should disabling the debugger require a password?
Yes, if you have specified that a password is required for the
debugger, then you will need to supply it when trying to deactivate
it..
Let me rephrase the question: Is there a reason to require the pw to disable debugmode? I don’t see a security risk in allowing debugmode to be disabled w/o a password.
If there is a valid reason, then the “turn debugger off” link needs to be adjusted to either prepopulate the password, or prompt for it (like the Reinitialize link).