Only log the $_SERVER information under YII_DEBUG (#18707)

* Only log the $_SERVER information under YII_DEBUG

Since $_SERVER can contain sensitive information that could leak in CI pipelines ideally it should happen under the YII_DEBUG flag only

* Added upgrade / changelog

* Corrected the upgrade information

* Update framework/UPGRADE.md

Co-authored-by: Alexander Makarov <sam@rmcreative.ru>

Co-authored-by: Bizley <pawel@positive.codes>
Co-authored-by: Alexander Makarov <sam@rmcreative.ru>

framework/CHANGELOG.md

@@ -12,6 +12,7 @@ Yii Framework 2 Change Log
 - Enh #18676: Added method `yii\helpers\BaseFileHelper::changeOwnership()` and properties `newFileMode`/`newFileOwnership` in `yii\console\controllers\BaseMigrateController` (rhertogh)
 - Bug #18678: Fix `yii\caching\DbCache` to use configured cache table name instead of the default one in case of MSSQL varbinary column type detection (aidanbek)
 - Enh #18695: Added `yii\web\Cookie::SAME_SITE_NONE` constant (rhertogh)
+- Enh #18707: Changed the base error handler to not expose `$_SERVER` details unless `YII_DEBUG` is enabled (coolgoose)
 - Enh #18712: Added `$scheme` option to `yii\i18n\Formatter::asUrl()` (bizley)
 - Bug #18648: Fix `yii\web\Request` to properly handle HTTP Basic Auth headers (olegbaturin)
 - Enh #18726: Added `yii\helpers\Json::$prettyPrint` (rhertogh)

framework/UPGRADE.md

@@ -51,6 +51,11 @@ if you want to upgrade from version A to version C and there is
 version B between A and C, you need to follow the instructions
 for both A and B.
 
+Upgrade from Yii 2.0.42
+-----------------------
+
+* `yii\base\ErrorHandler` does not expose the `$_SERVER` information implicitely anymore.
+
 Upgrade from Yii 2.0.41
 -----------------------
 

framework/base/ErrorHandler.php

@@ -169,10 +169,10 @@ abstract class ErrorHandler extends Component
             } else {
                 echo '<pre>' . htmlspecialchars($msg, ENT_QUOTES, Yii::$app->charset) . '</pre>';
             }
+            $msg .= "\n\$_SERVER = " . VarDumper::export($_SERVER);
         } else {
             echo 'An internal server error occurred.';
         }
-        $msg .= "\n\$_SERVER = " . VarDumper::export($_SERVER);
         error_log($msg);
         if (defined('HHVM_VERSION')) {
             flush();