Database connection error exposes database password

denemedeneme

Hi guys,

Today I realized that, my database password was on the screen with a error of "SQLSTATE[HY000] [1045] Access denied".

This error caused by my database, it went down somehow. Anyway, when flarum tried and doesn't find my mysql server, it gave me a error page like below:

tankerkiller125

denemedeneme If your running beta.15 this is a known issue. It was fixed in beta.16 I believe if I remember correctly.

denemedeneme

tankerkiller125 yes I am using beta15. I didn't know that, I just wanted to inform you guys.
8am in the morning, it was quite shocking for me.

clarkwinkelmann

That's an instance of this issue flarum/core2290 which I can confirm is fixed in Flarum beta 16.

As a workaround there are some PHP settings you can change so it doesn't expose parameters to methods in error messages.

denemedeneme

clarkwinkelmann can you give an example?

clarkwinkelmann

denemedeneme I don't know exactly myself. I think someone explained how they worked around it in the GitHub issue or maybe in the other discussion about this that I think we have on this forum.

If you can update Flarum, it'll be the easiest solution.

denemedeneme

clarkwinkelmann lots of extensions are not working with 16 now, so I am staying on 15 for a while, but eventually I will.

Braden

@denemedeneme inside core/Http/Server.php
you will find a code that looks like this which if you replace it will work

private function safelyBootAndGetHandler()
    {
        try {
            return $this->site->bootApp()->getRequestHandler();
        } catch (Throwable $e) {
            error_log($this->formatBootException($e), 3, "/var/tmp/my-errors.log");
            echo("Database is currently not available. See logs for more details.");
            exit(1);
        }
    }