? ? Pending

User tests: Successful: Unsuccessful:

avatar zero-24
zero-24
23 Feb 2017

Pull Request for Issue #14215

Summary of Changes

on error show generic message (JLIB_DATABASE_GENERIC_SQL_ERROR) and log the actual message

Configure a SQL field with a crap sql query

Like:

screen shot 2017-02-23 at 18 47 30

Expected result

That no structure of my mysql tables is leaked to end users no matter what error SQL comes up with

Actual result

Leaking of parts of the SQL query, which may contain field names, and the raw mysql error message

screen shot 2017-02-23 at 18 47 53

Documentation Changes Required

Votes

# of Users Experiencing Issue
1/1
Average Importance Score
3.00

avatar zero-24 zero-24 - open - 23 Feb 2017
avatar zero-24 zero-24 - change - 23 Feb 2017
Status New Pending
avatar joomla-cms-bot joomla-cms-bot - change - 23 Feb 2017
Category Libraries
avatar PhilETaylor
PhilETaylor - comment - 23 Feb 2017

This PR has commit c509358 which is not part of this issue

avatar zero-24
zero-24 - comment - 23 Feb 2017

Yes this is the reason for this commit 8741706 which reverts the commit you mention

a6cb6d9 23 Feb 2017 avatar zero-24 typo
avatar zero-24 zero-24 - change - 23 Feb 2017
Labels Added: ?
avatar PhilETaylor
PhilETaylor - comment - 23 Feb 2017

ah....

avatar zero-24
zero-24 - comment - 23 Feb 2017

@mbabker please review eedea83

avatar PhilETaylor PhilETaylor - test_item - 23 Feb 2017 - Tested successfully
avatar PhilETaylor
PhilETaylor - comment - 23 Feb 2017

I now get:

screen shot 2017-02-23 at 19 39 31

I have tested this item successfully on bbac936


This comment was created with the J!Tracker Application at issues.joomla.org/tracker/joomla-cms/14217.

avatar PhilETaylor
PhilETaylor - comment - 23 Feb 2017

JLIB_DATABASE_GENERIC_SQL_ERROR is not defined in the language files yet???

I found some info here #7073 ?

avatar zero-24
zero-24 - comment - 23 Feb 2017

fixed 1f9c287

avatar Bakual
Bakual - comment - 23 Feb 2017

Imho just showing a message "An error has occurred." is a bit to generic. Can't we add a new string which gives the user a clue what happend? Maybe "An error occured with the database query in the 'foo' field, please notify the administrator" or something. The name of the field could be injected into the string so one at least knows where to look for,

avatar PhilETaylor
PhilETaylor - comment - 23 Feb 2017

The WHOLE POINT is that we DONT tell ANYONE what the column names in the tables are

Saying An error occured with the database query in the **'foo' field** is saying too much!

avatar Bakual
Bakual - comment - 23 Feb 2017

The "foo field" refers to the name of the custom field, not the database field.

avatar slibbe
slibbe - comment - 23 Feb 2017

I have tested this item succesfully.


This comment was created with the J!Tracker Application at issues.joomla.org/tracker/joomla-cms/14217.

avatar franz-wohlkoenig
franz-wohlkoenig - comment - 24 Feb 2017

RTC cause 2 successfully Tests?

avatar franz-wohlkoenig
franz-wohlkoenig - comment - 24 Feb 2017

@slibbe can you please mark your test in J-Issue as successfully?

avatar infograf768
infograf768 - comment - 24 Feb 2017

I agree with Bakual. We could have a new string before RC1 when we will freeze languages.

avatar csthomas
csthomas - comment - 25 Feb 2017

I agree that we should hide errors about sql structure for end users.
But I want to have somewhere a reference what went wrong.

Can we add some log (or may I miss, where is it?) or simple code like:

JFactory::getApplication()->enqueueMessage(JText::_('JERROR_AN_ERROR_HAS_OCCURRED'), 'error');
trigger_error($e->getMessage()); // It generates a php notice
avatar mbabker
mbabker - comment - 25 Feb 2017

Using the JLog API you can either add a logger for the existing categories used to record errors or add your own logger subclass to do something like call trigger_error() (or really anything you choose).

avatar csthomas
csthomas - comment - 25 Feb 2017

Unrelated. I have found that I have to:

  • enable "Plugin: System - Debug"
  • set Log Categories to database-error
  • and set Log Almost Everything to Yes
  • now I can see sql errors in administrator/logs/everything.php

I thing that should be more simpler and won't require debug plugin which slow down production server.
But it is an idea for another PR.

avatar mbabker
mbabker - comment - 25 Feb 2017

To do it with the core distribution and no extra tools, you're right. But the platform is already there to support you adding your own plugin to catch messages logged with JLog::add() and handle them as you please. I don't think we need to work through core and add trigger_error() or error_log() calls every place an error condition is handled to push the condition to PHP's error handler.

avatar csthomas
csthomas - comment - 25 Feb 2017

Yes, I full agree. I mentioned about trigger_error() before I found above described settings in debug plugin.

avatar zero-24 zero-24 - alter_testresult - 4 Mar 2017 - PhilETaylor: Tested successfully
avatar zero-24 zero-24 - alter_testresult - 4 Mar 2017 - slibbe: Tested successfully
avatar zero-24 zero-24 - change - 4 Mar 2017
Status Pending Ready to Commit
avatar zero-24
zero-24 - comment - 4 Mar 2017

RTC based on the tests by @slibbe and @PhilETaylor if you want to ship a new language string we can do this in another PR ?

Thanks for testing.


This comment was created with the J!Tracker Application at issues.joomla.org/tracker/joomla-cms/14217.

avatar zero-24 zero-24 - edited - 4 Mar 2017
avatar wilsonge wilsonge - merge - 9 Mar 2017
avatar wilsonge wilsonge - change - 9 Mar 2017
Status Ready to Commit Fixed in Code Base
Closed_Date 0000-00-00 00:00:00 2017-03-09 16:45:05
Closed_By wilsonge
Labels Added: ?
avatar wilsonge wilsonge - close - 9 Mar 2017

Add a Comment

Login with GitHub to post a comment