Bootstrap/Load: Refactor debug.log handling for enhanced protection and usability

[itschristiandale]

This commit addresses concerns related to the /wp-content/debug.log file being publicly accessible, which may contain sensitive information in some circumstances. To mitigate this risk, a randomly generated string is now appended to the debug log filename.

Additionally, the debug logs have been relocated to a dedicated directory for improved organization and convenience. These changes enhance both the protection and usability of the debug.log subsystem.

This commit addresses concerns related to the /wp-content/debug.log file being publicly accessible, which may contain sensitive information in some circumstances. To mitigate this risk, a randomly generated string is now appended to the debug log filename.

Additionally, the debug logs have been relocated to a dedicated directory for improved organization and convenience. These changes enhance both the protection and usability of the debug.log subsystem.

Trac ticket: https://core.trac.wordpress.org/ticket/60611

Instead of generating a new debug log for every request, maybe we could use a deterministic, unique filename based on that site's salts? If the debug log file is persistent, I think there's no need for the debug directory, we basically keep everything as-is, but just randomize the debug log filename. Also, it could be prefixed with a dot to leverage the "hidden file" convention, as most web servers won't serve hidden files to web clients.

Instead of generating a new debug log for every request, maybe we could use a deterministic, unique filename based on that site's salts? If the debug log file is persistent, I think there's no need for the debug directory, we basically keep everything as-is, but just randomize the debug log filename. Also, it could be prefixed with a dot to leverage the "hidden file" convention, as most web servers won't serve hidden files to web clients.

Instead of generating a new debug log for every request, maybe we could use a deterministic, unique filename based on that site's salts? If the debug log file is persistent, I think there's no need for the debug directory, we basically keep everything as-is, but just randomize the debug log filename. Also, it could be prefixed with a dot to leverage the "hidden file" convention, as most web servers won't serve hidden files to web clients.

@Luc45 Thank you for your feedback. I have made the suggested changes.