Page 1 of 1

Security compromised when MySQL is down.

Posted: Tue Apr 04, 2017 10:34 pm
by neeticollections
Hello,
The MySQL on my hosting company went down. During this time, accessing the front end of my site was showing below error and was listing the user id and password for my website's database. This is a big flaw. I think the code should catch the error and return more user friendly message on the front end. The technical details and trace logs can be sent to Systems-> Error Logs.in the Admin section of the site.

prntscr.com/esawcp

Re: Security compromised when MySQL is down.

Posted: Tue Apr 04, 2017 10:48 pm
by IP_CAM
that's a real Problem, and the possibly only way, to prevent it, would be, to have
a top hoster, in order to avoid, a DB to ever be out of service.
Ernie

Re: Security compromised when MySQL is down.

Posted: Tue Apr 04, 2017 11:20 pm
by neeticollections
Hello,
No matter if you have the best hosting company in the world, the outage would happen once in a while. I think the code should be smart to NOT show user id / password or other details that could compromise the security.

Somebody please help me with some fix / solution / work around.

Re: Security compromised when MySQL is down.

Posted: Wed Apr 05, 2017 6:34 am
by IP_CAM
well, I assume, it's a Server Information.
Ernie

Re: Security compromised when MySQL is down.

Posted: Wed Apr 05, 2017 2:37 pm
by artcore

Re: Security compromised when MySQL is down.

Posted: Wed Apr 05, 2017 4:02 pm
by neeticollections
Thanks artcore !!

I have added following code in - system/library/db/mysqli.php

if ($this->connection->connect_error) {
die('Unable to connect to database');
}

Re: Security compromised when MySQL is down.

Posted: Wed Apr 05, 2017 4:57 pm
by artcore
Or 'something went wrong, please contact the webmaster'. No one needs to know details ;D