Post by nonnedelectari » Fri Apr 18, 2025 2:30 pm

Joe1234 wrote:
Fri Apr 18, 2025 1:48 pm
nonnedelectari wrote:
Wed Jan 22, 2025 9:18 am
On exception catching:

We use this in system/framework.php

Code: Select all

function exit_nicely () {
	$headers = array_change_key_case(apache_request_headers(),CASE_LOWER);
	$json_req = ((array_key_exists("accept",$headers) && stristr($headers['accept'],'application/json')) ? true : false);
	$ajax_req = ((array_key_exists("x-requested-with",$headers) && $headers['x-requested-with'] == 'XMLHttpRequest') ? true : false);
	error_log('Framework: exiting nicely');
	if ($json_req || $ajax_req) {
		error_log('Exception handler: Returning json error record to '.$_SERVER['REMOTE_ADDR'].' for '.$_SERVER['REQUEST_URI']);
		$json = array();
		$json['error']['warning'] = 'Sorry, we seem to be experiencing some difficulties, please try again or contact us directly.';
		$json['success'] = 'Sorry, we seem to be experiencing some difficulties, please try again or contact us directly.';
		$json_serial = json_encode($json);
		error_log($json_serial);
		header('Content-Type: application/json');
		echo $json_serial;
	} else {
		error_log('Exception Handler: Showing static maintenance page to '.$_SERVER['REMOTE_ADDR'].' for '.$_SERVER['REQUEST_URI']);
		ob_start();
		include('maintenance.html');
		$problem_page = ob_get_clean();
		http_response_code(503);
		echo $problem_page;
	}	
	die();	
}

set_exception_handler("handle_exception");
function handle_exception ($exception) {
	error_log($exception->getFile().' - line: '.$exception->getLine().' - Message: '.$exception->getMessage().' - '.$exception->getTraceAsString());
	exit_nicely();
}
catches the exceptions and returns a static maintenance page (maintenance.html) or a json encoded record with a non technical message in case an ajax request was made (takes care of those awkward json syntax error popups with html error messages).
In the meantime it logs the necessary info in your php error log.
HI, a few questions:
1/ How specifically can I test this, force the error, to make sure it is functioning correctly on my site as opposed waiting to see if I get the similar errors ever again?
2/ Should this code be inserted at a specific point in the file (just to make sure something doesn't need to be activated first)?
3/ What directory should 'maintenance.html' be placed in?
Thanks.
1) you could simply force an sql exception by changing an sql statement.
2) those are just functions so anywhere in framework.php will do
3) the code as is assumes your root, but you can alter that to includes/maintenance.html and put it in your includes directory.
PS. it has to be a static html page, so no php and no sql or you may trigger the error at hand in a loop.

In your php error log you would get something like this when an sql error occurs (I changed the field country_id to country_ids in the query which does not exist):

Code: Select all

[18-Apr-2025 14:41:29] /system/library/db/mysqli.php - line: 160 - Message: Error: Unknown column 'country_ids' in 'field list'<br />Error No: 1054<br />select country_ids from oc_country where iso_code_2 = 'SG' - #0 /system/library/db.php(143): DB\MySQLi->query('select country_...')
#1 /catalog/controller/startup/startup.php(2587): DB->query('select country_...')
#2 /storage/modification/system/engine/action.php(78): ControllerStartupStartup->index()
#3 /system/engine/router.php(34): Action->execute(Object(Registry))
#4 /system/engine/router.php(19): Router->execute(Object(Action))
#5 /system/framework.php(313): Router->dispatch(Object(Action), Object(Action))
#6 /system/startup.php(123): require_once('/...')
#7 /index.php(25): start('catalog')
#8 {main}
[18-Apr-2025 14:41:29] Framework: exiting nicely
[18-Apr-2025 14:41:29] Exception Handler: Showing static maintenance page to xxx.xxx.xxx.xxx for /
The client will get your static maintenance page for normal http requests whereas ajax calls will receive a json encoded record.

Still, while this will catch and handle exceptions which are thrown but not caught, you still need to close your sql injection hole as this does not do that for you.

Active Member

Posts

Joined
Thu Mar 04, 2021 6:34 pm

Post by Joe1234 » Sat Apr 19, 2025 6:29 am

Thanks, looks good so far. Two questions, did you modify the original framework file, or do you have one in the modification folder? Any idea how to force a 1064 error specifically?

v3.0.4.0 php 8.1
I'm here for a reason, if your response is contact a/the developer, just don't reply.


Active Member

Posts

Joined
Sat Jan 01, 2022 5:47 am

Post by nonnedelectari » Sat Apr 19, 2025 7:48 am

Joe1234 wrote:
Sat Apr 19, 2025 6:29 am
Thanks, looks good so far. Two questions, did you modify the original framework file, or do you have one in the modification folder? Any idea how to force a 1064 error specifically?
We changed the original.
A 1064 is an sql syntax error so you can just change a query to have such, add a quote, change "where" to "were", any sql syntax error will do.
Most amateur hackers will try to inject a quote into one of your queries (by adding a quote to the urls) to see if it produces an error which would indicate that your site is vulnerable to sql injections.

PS. you can also put it in index.php but then you have to do it in both catalog and admin, framework.php covers both sides.

There we also have this to handle php errors which do not throw an exception.

Code: Select all

register_shutdown_function("shutdownHandler");
function shutdownHandler() {
	$lasterror = error_get_last();
	switch ($lasterror['type']) {
		case E_ERROR:				$error = 'ERROR';break;
		case E_CORE_ERROR:			$error = 'CORE_ERROR';break;
		case E_RECOVERABLE_ERROR:		$error = 'RECOVERABLE_ERROR';break;
		case E_PARSE:				$error = 'PARSE';break;
		default:					$error = false;
	}
	if ($error) {
		error_log('Showing static problem page to '.$_SERVER['REMOTE_ADDR'].' for '.$_SERVER['REQUEST_URI']."\n".print_r($lasterror,true));
		ob_start();
		include(DIR_INCLUDES.'problem-en.html');
		$problem_page = ob_get_clean();
		http_response_code(503);
		header('Retry-After: 300');
		echo $problem_page;
		exit();
	}
}
same principle, different static html file which is in the includes directory.

Active Member

Posts

Joined
Thu Mar 04, 2021 6:34 pm
Who is online

Users browsing this forum: No registered users and 25 guests