Pimcore ENV Variables and Cookie Informations are exposed in http_error_log

@@ -0,0 +1,44 @@
+<?php
+
+declare(strict_types=1);
+
+/**
+ * Pimcore
+ *
+ * This source file is available under two different licenses:
+ * - GNU General Public License version 3 (GPLv3)
+ * - Pimcore Commercial License (PCL)
+ * Full copyright and license information is available in
+ * LICENSE.md which is distributed with this source code.
+ *
+ *  @copyright  Copyright (c) Pimcore GmbH (http://www.pimcore.org)
+ *  @license    http://www.pimcore.org/license     GPLv3 and PCL
+ */
+
+namespace Pimcore\Bundle\CoreBundle\Migrations;
+
+use Doctrine\DBAL\Schema\Schema;
+use Doctrine\Migrations\AbstractMigration;
+
+final class Version20251217000100 extends AbstractMigration
+{
+    public function getDescription(): string
+    {
+        return 'Remove parametersPost, cookies and serverVars from http_error_log';
+    }
+
+    public function up(Schema $schema): void
+    {
+        $this->addSql('
+            ALTER TABLE `http_error_log`
+                DROP COLUMN `parametersPost`,
+                DROP COLUMN `cookies`,
+                DROP COLUMN `serverVars`
+        ');
+    }
+
+    public function down(Schema $schema): void
+    {
+        // do nothing
+    }
+}

@@ -105,7 +105,6 @@ show_in_tree: "Zobrazi\u0165 v strome"
 exactmatch: "presn\xE1 zhoda"
 desktop: "Stoln\xFD po\u010D\xEDta\u010D"
 drag_me: Potiahni ma
-serverVars: "Premenn\xE9 serveru"
 attributes: "Atrib\xFAty"
 code: "K\xF3d"
 tag: Tag

@@ -100,7 +100,6 @@ show_in_tree: "Visa i tr\xE4dstruktur"
 exactmatch: Exakt matching
 desktop: Dator
 drag_me: Dra mig
-serverVars: Server-variabler
 attributes: Attribut
 code: Kod
 tag: Tag

@@ -63,7 +63,7 @@ public function httpErrorLogAction(Request $request): JsonResponse
             $filter = $db->quote('%' . $filter . '%');
 
             $conditionParts = [];
-            foreach (['uri', 'code', 'parametersGet', 'parametersPost', 'serverVars', 'cookies'] as $field) {
+            foreach (['uri', 'code', 'parametersGet'] as $field) {
                 $conditionParts[] = $field . ' LIKE ' . $filter;
             }
             $condition = ' WHERE ' . implode(' OR ', $conditionParts);
@@ -96,7 +96,7 @@ public function httpErrorLogDetailAction(Request $request, ?Profiler $profiler):
         $data = $db->fetchAssociative('SELECT * FROM http_error_log WHERE uri = ?', [$request->query->getString('uri')]);
 
         foreach ($data as $key => &$value) {
-            if (in_array($key, ['parametersGet', 'parametersPost', 'serverVars', 'cookies'])) {
+            if ($key === 'parametersGet') {
                 $value = unserialize($value);
             }
         }

@@ -91,9 +91,6 @@ protected function logToHttpErrorLog(Request $request, int $statusCode): void
                 'uri' => $uri,
                 'code' => $statusCode,
                 'parametersGet' => serialize($_GET),
-                'parametersPost' => serialize($_POST),
-                'cookies' => serialize($_COOKIE),
-                'serverVars' => serialize($_SERVER),
                 'date' => time(),
                 'count' => 1,
             ]);

@@ -3,9 +3,6 @@ CREATE TABLE IF NOT EXISTS `http_error_log` (
     `uri` varchar(1024) CHARACTER SET utf8 COLLATE utf8_bin DEFAULT NULL,
     `code` int(3) DEFAULT NULL,
     `parametersGet` longtext,
-    `parametersPost` longtext,
-    `cookies` longtext,
-    `serverVars` longtext,
     `date` int(11) unsigned DEFAULT NULL,
     `count` bigint(20) unsigned DEFAULT NULL,
     PRIMARY KEY (`id`),

@@ -44,19 +44,17 @@
 <h2>{{ data["code"] }} | {{ data["uri"] }}</h2>
 
 {% for key,value in data %}
-    {% if key in ["parametersGet", "parametersPost", "serverVars", "cookies"] %}
-        {% if value is not empty %}
-            <h2 class="sub">{{ key|trans([], 'admin') }}</h2>
-
-            <table>
-                {% for key,value in value %}
-                    <tr>
-                        <th valign="top">{{ key }}</th>
-                        <td valign="top">{{ value }}</td>
-                    </tr>
-                {% endfor %}
-            </table>
-        {% endif %}
+    {% if value is not empty and key == "parametersGet" %}
+        <h2 class="sub">{{ key|trans([], 'admin') }}</h2>
+
+        <table>
+            {% for key,value in value %}
+                <tr>
+                    <th valign="top">{{ key }}</th>
+                    <td valign="top">{{ value }}</td>
+                </tr>
+            {% endfor %}
+        </table>
     {% endif %}
 {% endfor %}