I do agree with you, but I think in this case it is a DotClear issue.
The default themes provided with DotClear do not check that they have
been called by a regular DotClear page, and spit out useful information
for an attacker.
They should check that a certain variable is defined for example, and if
not, do not display anything... even if the hosted website is configured
to display errors, and you cannot change this.
Fatal error: Call to a member function fetch() on a non-object in
/home/users/xxxx/dotclear/themes/xxx/list.php on line 34
Note it's not wise to display errors on a production website. However,
when hosted, you don't necessarily have this choice...
