Security Vulnerability Detected caused by Badge OS – Where can I deactivate the display_errors?

[LirieVS]

Description

Thanks in advance for your assistance!

Today I received this error message on our site https://bootcampinstitute.com:

Memberium has detected that your website or web hosting is misconfigured to display errors to the browser... (see full error message below)

I ran our site through Sucuri, and no malware was found and our site is at a low security risk.

I also reached out to our host, WP Engine and they are not familiar with the error.

I then reached out to the Memberium team They concluded:

_We can confirm that after deactivating the BadgeOS Plugin, the error message was gone. It appears BadgeOS is enabling displayerrors. To better assist you, you will need to reach out to BadgeOS support.

Will you please help guide me to next steps? Where can I deactivate the display_errors?

Steps to Reproduce

1. I'm happy to provide Admin login, just let me know.
2. Error appears on top of every page in the backend of our site: https://bootcampinstitute.com
3. See full error message below

Actual result:

I'm not seeing any issues on the front end as of evening of June 18th. However, I'm not sure the full effects this error is causing to our site.

Expected result:

Fix issue so error message does not show in back end. / Deactivate display_errors

Product Versions

• BadgeOS: 3.6.10
• BadgeOS BadgeStack Add-On 1.0.1
• BadgeOS Congratulations Modal Add-On 1.0.5
• BadgeOS LearnDash Add-On 1.2.1
• WordPress: 5.7.2

Additional Information. See full error message here: https://www.dropbox.com/s/uqzugg3w0j60kz1/BCI%20Error%20view%201.png?dl=0

Thanks so much for your time and any insight!

-lirie@bootcampdigital.com

N/A

[StefanB997]

Just wanted to open a new issue for this and saw your post. There are error displaying lines (probably forgotten) in the following files:

• /includes/open_badge/class-open-badge.php (located inside constructor)
• /includes/open_badge/ob_metabox.php (located inside convert_to_open_badge)

Look for ini_set( 'display_errors', 'On' ); error_reporting(E_ALL);. I removed them from the plugin and errors no longer appear on the front.

[LirieVS]

Thank you Stefan, The issue has been addressed and the plugin is again working as expected. Thank you for your response.

Lirie