From 230052c9336cc47b646fa934061de134461ae27c Mon Sep 17 00:00:00 2001 From: Mark Scherer Date: Mon, 12 Oct 2026 14:22:04 +0200 Subject: [PATCH 1/2] Let a failed app.php load fail with a non-zero status bootstrap.php caught the exception from loading config/app.php and passed its message to exit(). exit() with a string prints it and ends with status 0, so a broken config made bin/cake commands report success, and the web SAPI answered 200 with the message in the body and nothing in the log. The error and exception traps are not registered yet at this point, since they need the Error config from app.php. Dropping the catch leaves the exception to PHP: status 255 on the CLI, a logged 500 on the web, with the output governed by display_errors and log_errors. --- config/bootstrap.php | 8 ++------ 1 file changed, 2 insertions(+), 6 deletions(-) diff --git a/config/bootstrap.php b/config/bootstrap.php index 82a92c60f..7adc5fd66 100644 --- a/config/bootstrap.php +++ b/config/bootstrap.php @@ -81,12 +81,8 @@ * - `config/app.php` for the default application configuration. * - `config/app_local.php` for environment specific configuration. */ -try { - Configure::config('default', new PhpConfig()); - Configure::load('app', 'default', false); -} catch (Exception $e) { - exit($e->getMessage() . "\n"); -} +Configure::config('default', new PhpConfig()); +Configure::load('app', 'default', false); /* * Load an environment local configuration file to provide overrides to your configuration. From f940f85ef5f96e1b8b3aab25cf388ee1107d6d37 Mon Sep 17 00:00:00 2001 From: Mark Scherer Date: Mon, 12 Oct 2026 16:35:33 +0200 Subject: [PATCH 2/2] Report a failed app.php load explicitly instead of rethrowing Keep the catch, but end with a failure: on the CLI the message goes to stderr and the exit status is 1, on the web the message is written to the error log and the response is a 500 with an empty body. This keeps the one-line CLI output instead of a stack trace, and never shows the message or file paths to visitors regardless of display_errors. error_log() is skipped on the CLI because its default destination there is stderr, which printed the message twice. --- config/bootstrap.php | 15 +++++++++++++-- 1 file changed, 13 insertions(+), 2 deletions(-) diff --git a/config/bootstrap.php b/config/bootstrap.php index 7adc5fd66..e05ec9fe2 100644 --- a/config/bootstrap.php +++ b/config/bootstrap.php @@ -81,8 +81,19 @@ * - `config/app.php` for the default application configuration. * - `config/app_local.php` for environment specific configuration. */ -Configure::config('default', new PhpConfig()); -Configure::load('app', 'default', false); +try { + Configure::config('default', new PhpConfig()); + Configure::load('app', 'default', false); +} catch (Exception $e) { + // The error and exception traps need app.php, so report the failure by hand. + if (PHP_SAPI === 'cli') { + fwrite(STDERR, $e->getMessage() . "\n"); + } else { + error_log($e->getMessage()); + http_response_code(500); + } + exit(1); +} /* * Load an environment local configuration file to provide overrides to your configuration.