Page MenuHomePhabricator

Backtrace should not include parameters as they may contain private data
Closed, ResolvedPublic

Description

Author: nat

Description:
Stoping the database (MySQL 5.0, Debian testing) server during an operation
raises an exception which dumps various informations to the visitor's browser.
Among them:

  • the database name
  • the corresponding login and password

It reveals secrets, albeit $wgShowSQLErrors=false;

The URL provided leads to the dump (slightly edited)

Thank you


Version: 1.8.x
Severity: critical
OS: Linux
Platform: PC
URL: http://www.linux-france.org/MW_db_err.html

Details

Reference
bz7096

Event Timeline

bzimport raised the priority of this task from to Medium.Nov 21 2014, 9:27 PM
bzimport set Reference to bz7096.
bzimport added a subscriber: Unknown Object (MLST).

nat wrote:

Fixed under 1.8.2 (but $wgShowSQLErrors seems useless now)