When for some reason a database connection problem occurs, drupal unconditionally displays the database error, the username and the address of the database server. Although there is no real risk, there is no reason for publicly displaying these information on a production server. It's the same as the PHP errors which are usually not displayed on a production server. (display_errors = Off)

It would make sense to display these information only if display_errors = On. This patch checks the status of display_errors with ini_get() before generating the content of the page.

Support from Acquia helps fund testing for Drupal Acquia logo

Comments

scor’s picture

working with mysql, mysqli and pgsql.

moshe weitzman’s picture

looks reasonable to me. needs testing.

scor’s picture

moshe: that's what I showed you at the end of the 'Help us Polish and Release' session at drupalCon.
Note that the code of this patch is fired only when a db connection problem occurs. needs more review nonetheless.

Gábor Hojtsy’s picture

Status: Needs review » Needs work

- Mysql should be MySQL in the new text portions of the patch
- The real underlying problem is not what geeky message we display but whether we display a geeky message or a friendly one. Unfortunately if there is no database, we cannot display a page which was set on the admin interface (as with 404 and 403 pages). What we could do however is to provide a setting to specify the text on the page somehow.

I think this needs to be thought through properly. What is possible by theming this page? Should we document that better or make it easier, or should we provide settings for how would it be possible to "ungeek" this page?!

scor’s picture

Status: Needs work » Needs review
FileSize
9.38 KB

Good points Gábor:

- the patch attached fixes the MySQL typos.

- my idea was to come up with something as simple and lightweight as possible to be able to hide these db details on a production site, without adding any extra variable to the core (and using one from php.ini instead). There are other alternatives:
1. display a more friendly message in my patch with eventually a link to the drupal.org documentation explaining how to set display_errors to on etc...
2. a global variable in settings.php that the developer can edit and specify its own friendly message. Some people don't like the idea of having an extra global variable, so it could be commented by default (on the out of the box installation).
3. as drumm suggested me, we could have a html file in the sites directory which would be loaded in that case. The developer would be free to theme this page the way she wants.

The list could go on, many people talked about this already, but it never worked out because it was too complex to consider the different levels of tweaking together. Let's make it simple this time. In a part 2 of this thread, we could discuss the advanced tweaking solutions if you want, but in any case we need to provide a default message out of the box, because most people won't bother writing their own message or theming an error page. That's the purpose of this patch: simple and lightweight.

Gábor Hojtsy’s picture

IMHO we should not reinvent the wheel. There are methods to define what is displayed on a page and how it is displayed on a page. We have an answer for the second: maintenance page theming. So we need to find says to customize what is displayed when a database error is encountered.

We have a default error message which provides a bit too much information for the visitor. But it is very good for debugging reasons. Instead of teaching people PHP, and linking out to Drupal.org, why not encourage them to think about their users? I'd recommend:

- adding two PHP array level settings to settings.php which provide the title and body for the database error page
- if these are specified, use their contents
- if not either display the full error as it is now, or if we'd like to go that extra mile (why not:) display an intermediary error message as it is suggested here

Because these are very closely related IMHO, we should fix them all at once. Now that we have maintenance theming, I do think this is an obvious way to go and not standalone HTML files, as argued before (and as I myself also use them on some sites).

JirkaRybka’s picture

Good points. Just wanted to say my opinion: Database details on error page are not only ugly for end-users, but also kind of useless for the webmaster, who is still able to check these in settings.php - and if he can't for some reason, he's probably unable to debug the site anyway. So - aside from customizing/theming and that stuff - I would vote for the default message without details (or with a reminder to check settings.php, but no more).

webchick’s picture

Note that http://drupal.org/node/141727 (which allows theming of maintenance pages) is a more comprehensive approach to the "let me control exactly what's shown" problem. I would vastly prefer that to doing things like adding arrays in settings.php to control presentation, as that's an extremely slippery slope. It remains to be seen whether or not that can get that patch into 6.x.

This approach seems like a reasonable alternative to me; we can't use Drupal's error_level variable, since we have no database, so we use PHP's equivalent instead.

webchick’s picture

Pardon me. I said "alternative" but that's not what I meant. I meant that the two could co-exist well.

Power users and developers are going to want control over exactly how this page looks, what it says, etc. The solution for them is to make maintenance pages themable, so they can go to town.

New users, however, shouldn't have to understand the theming system in order to hide this information. This patch caters to them.

scor’s picture

Following up on webchick comments, I suggest to split this in 2 parts:
1- use the dispay_errors PHP setting to display the db information on a dev site only, and display a friendly message on a production site (display_errors=off). adding variable to settings.php is an idea that many people dislike (webchick, steven). This patch caters for all that.
2- make the page themeable and provide documentation on how to theme it. This will be used by the advanced users.

The reason why I suggest this split is because I doubt that the part 2 will be implemented and tested on time before Drupal 6 release. However part 1 is pretty straight forward and would provide a fix to the problem for Drupal 6. Having a themable maintenance page is great, but the newbies won't use it! We need to think of them too... so the part 1 is therefore necessary in any case. If you think the message is not friendly enough, feel free to suggest something else.

Gábor Hojtsy’s picture

My fundamental problem as explained is that we are displaying a message to a visitor here, not to a site maintainer. The previous test was precisely tailored to the site maintainer and the short version is still just that. I don't think this patch solves the underlying issue.

Gábor Hojtsy’s picture

Previous text, I mean.

scor’s picture

All right Gábor, I get your point now.
If we make this maintenance page themeable, we still have to decide on a default message to display (for the newbies who won't bother theming it).
Do you think it's feasible to make this page themeable (patch and testing) before the drupal 6 release?

JirkaRybka’s picture

I guess theming is quite too much for this moment in D6 release cycle... (?) Should we consider just the message for now?

Gábor Hojtsy’s picture

We can still target the text to the end user and not the site maintainer, providing a small hint to the site maintainer only. Unfortunately no activity in this issue in a month made more extensive themeing late for D6 :(

JirkaRybka’s picture

Okay, attaching a patch with only the texts changed. The hint for maintainer is now minimal, which is IMO correct - we have nice installer now, so these error-pages are only shown if the server goes down, and doesn't serve as install-troubleshooting help anymore. Also the hint is now formatted as a tiny footnote only, below an usual "try again later" message for the end users. The manual-page link is taken from existing code without change. I think that the "Troubleshooting FAQ" section should have a page on this subject, though.

Attaching the patch, as well as screenshots before/after. Tested on MySQL only.

scor’s picture

Thanks JirkaRybka for your suggestion.
The title of the page should reflect the changes also. 'Site unavailable' or 'Site off-line' sounds more appropriate for the end users.
Also, in the case of a database issue, the whole site is likely to be unavailable, not only the requested page.
(The db details should be triggered on the display_errors PHP variable, but I'll reroll a patch with this trigger once we agree on the right message to be displayed.)

JirkaRybka’s picture

FileSize
9.99 KB

Updated patch, with page titles and 'site' instead of 'requested page'. I also noticed that the HTML header was set inconsistently, only for SOME errors, so fixed that too.

The db details on display_errors - well, it would be consistent indeed, but IMO not necessary. There's already a reminder to check settings.php, which contains all the details. The site maintainer is probably going to visit that file anyway, so there's not much need to add extra code to show name/host on the page too. Just my opinion on this part...

JirkaRybka’s picture

This still applies cleanly.

More feedback welcome. This needs to be fixed IMO, the text for D6 shouldn't wait. (Rest is for D7 now)

JirkaRybka’s picture

Category: feature » bug

I just realized, that this was probably not getting attention, because it was set to "feature". That was true while considering theming, but now this is only about the message again - and THIS is clearly UI bug, a confusion between messages facing site *visitor* and site *maintainer*. So updating category now.

catch’s picture

The wording looks much, much better, and yes this is much more for site visitors than admins. If you're an admin and your site goes down, the existing error message doesn't tell you anything you don't know already, and if you don't know, it won't help you. So a big +1 from me.

Gábor Hojtsy’s picture

Status: Needs review » Needs work

As far as I see:

- we can loose the () around the small text
- "handbook" => "the handbook"
- it would be better to make these small admin notes shorter *and* include a TROUBLESHOOTING.txt in Drupal, where the original troubleshooting tips are included, and this error message can point to there. Currently it points to the root of the getting started guide, which still requires the admin to look around and find where these things are explained

So basically, not treating the viewer the site admin with the error messages is IMHO all good, but site admins should still have good instructions, to which this patch should only add a little bit of indirection.

JirkaRybka’s picture

The '()' and 'the handbook' are fine with me, going to include on next re-roll...

But let's discuss the rest a bit:
Old:

If you still have to install Drupal, proceed to the installation page.

If you have already finished installing Drupal, this either means that the username and password information in your settings.php file is incorrect or that we can't connect to the MySQL database server. This could mean your hosting provider's database server is down.

The MySQL error was: **** .

Currently, the username is **** and the database server is ****.

- Are you sure you have the correct username and password?
- Are you sure that you have typed the correct hostname?
- Are you sure that the database server is running?

For more help, see the Installation and upgrading handbook. If you are unsure what these terms mean you should probably contact your hosting provider.

New:

The site is currently not available due to technical problems. Please try again later. Thank you for your understanding.
--------------------------------
(If you are the maintainer of this site, please check your database settings in the settings.php file, and whether your hosting provider's database server is running. The MySQL error was: ****. For more help, see handbook, or contact your hosting provider.)

Apart from the mention of install process (which is probably not the case now, with our current installer), the database username/server (which is rather private information, and may be easily found in settings.php), and some redundancy (twice mentioned username/password, server not/running), the new wording say basically the same: Check settings.php, whether the server is up, read manual or contact hosting provider, and here is your error message. Amen. The provided link is the same as previously, too. Showing the DB error message is IMO unavoidable, as it's the only really useful part for the maintainer, which can't be observed (easily) elsewhere.

So, this patch only changes wording to be more site-visitor focused, without really changing the contents of that page. I think changing the contents is out of this issue scope - if we want to add a really sensible and useful TROUBLESHOOTING.txt to Drupal, it would probably require nothing less than a summary from corresponding handbook section, or at the very least some common pitfalls (installing and file permissions, legendar "how to log in on maintenance mode", update.php access and usage, how to disable bad module manually, how to get rid of broken clean URLs etc. etc....)

That would probably mean a lot of discussion, arguing whether such a file is even needed (and yes, it would be another instance of the same texts to be kept up-to-date), a lot of work... Forgive me my pesimism, but I don't think that such a task is realistic for D6 timeframe. (See also where http://drupal.org/node/191310 got stuck.)

We already postponed the theming attempt here. I would say - let's drop changes to the text's logic too. We need to make it visitor-focused first of all. Then we can do more, if possible - or postpone if appropriate.

More opinions welcome :) I will be happy to reroll with any suggested text.

JirkaRybka’s picture

Status: Needs work » Needs review
FileSize
10 KB

Re-rolled without '()' and with 'the' for now...

scor’s picture

FileSize
10.67 KB

Very various reasons (see the beginning of this issue), the database error should not be displayed on production sites, but only on dev sites. Let's use the PHP display_errors setting to trigger this as Moshe suggested. I rerolled the patch keeping the same friendly message, but disabling the database error message when display_errors = Off.

JirkaRybka’s picture

As for me - it's rather production site suddenly down (if anything), where I need to see error message, to know what to tell my hosting provider. Testing environment is likely to show errors on install-time only, unless I changed something consciously.

But OK, I see general agreement here is leaning towards dispaly_errors route, and I've no problem with that. I don't strictly need to see *any* error messages on the front-end.

scor’s picture

it's rather production site suddenly down (if anything), where I need to see error message

JirkaRybka, the logs on the server are there to help you.

JirkaRybka’s picture

Fine. I never got a chance to access these on the shared webhosting where the site is, as well as I have no permission to create another database, to use .htaccess URL rewriting, to set_time_limit(), or to execute command-line things in any way... But I guess that I'm the only one here with so limited permissions on live server...?

But anyway, no need to discuss this further. I already said, that I'm OK with removing the error message; the plain fact that the page got displayed is sufficient for me. If there's agreement on dispaly_errors way (seems like that), let's have it so. Visitor focused text is most important here.

JirkaRybka’s picture

#25 still applies with just a tiny offset, and needs some review. Most of the patch was my proposal, and my setup makes the display_errors part hard to review too, so I'm not going to set this RTBC; leaving that to others ;)

JirkaRybka’s picture

"Bump" - that's what people call it here? Just a reminder that this needs to be fixed IMO; I feel really bad when the db-down screen appears, and I know that all site visitors see that techno-page.

Gábor Hojtsy’s picture

Two things:

- I'd like to see more feedback from the development community (ie. post on the devel list and ask for feedback as comments on this issue). These error messages removed by this patch (which I don't like either) serve an important debugging purpose, and help people solve their problems much more quickly. As said earlier, I am not sure they are to be completely removed when error reporting on on.

- All error messages introduced with this patch look identical. Why not have a central error message function then? Only the single line error message part looks different in these pages.

JirkaRybka’s picture

The patch only just changes existing messages (this code duplication is pre-existing), it should be possible to change easily, but testing would be quite difficult (I don't have PgSQL). Also if we need to communicate and discuss this in mailing lists, considering the issue queue insufficient/inappropriate, then it'll be nice if someone else step in.

I'm sorry, but although the above comment is good and valid feedback here, it makes this issue go beyond my possibilities (I'm not on any mailing lists, purely for time matters - the issue queue alone consumes 90% of my Drupal-available time for just reading, given my sub-optimal English skills). I would say that I de-assign myself now, for time matters, but I was not really assigned anyway. ;)

Thanks for the comment, still.

Gábor Hojtsy’s picture

The existing messages provide context sensitive tips on what might have gone wrong, although these overlap somewhat. I specifically asked this:

(ie. post on the devel list and ask for feedback as comments on this issue)

So I did not say this issue queue is not sufficient. I said we need to breathe in some life here and gather feedback. I'll post a note to the mailing list.

JirkaRybka’s picture

Thanks a lot :)

(This little misunderstanding only just underlines my need to learn further about the other ways of communication here in community, which would mean another evening worth of research for me, probably. My Drupal activity in general is growing over my time resources, I'm afraid. Going to stop posting rants, now ;)

keith.smith’s picture

In response to #31 (request for additional feedback), I completely support this patch.
-- There are debugging avenues open to the site owner that go outside relying on information from the current error message.
-- To quote statistics that I am even now making up, 90% of sites aren't going to theme these pages, and will rely on the default presentation.
-- The default presentation presents too much information to the general public, even if nothing it reveals is inherently damaging information. See this article, complete with screenshots of this page in the wild: http://soopergeek.blogspot.com/2007/11/unity08com-oops.html

Anonymous’s picture

I'm in favor of the patch. We could take it further and add an email field to page to so the admin can have an immediate alert; a feature request will be opened. I don't have D6 up yet so I can't give a hand at the moment in testing, sorry.

chx’s picture

Opinions here, not much time for test, sorry! Most of the current message most of the time makes no sense since the installer is in -- if you'd have mistyped this or that you wouldn't be installed in the first place. Therefore, I support the idea of this patch. I am not 100% I ike the current text but honestly, I do not really care, at the end of day, the actual message matters not that much as long as there is a friendly message. Any serious site is monitored by nagios or similar and if the normal page disappears, it'll alarm anyways, so do not sweat with emailing or somesuch.

catch’s picture

Where do we get the e-mail from if not the database? Not a bad idea, but I think this could be done at theme level.

+1 for this patch anyway.

Gábor Hojtsy’s picture

Status: Needs review » Needs work

It's great to see so much support for this. So all is left on the code part IMHO is to centralize this instead of repeating the same stuff in all places, and parameterize the variables.

Anonymous’s picture

Where do we get the e-mail from if not the database?

See: http://drupal.org/node/200368

scor’s picture

Assigned: Unassigned » scor

it's nice to get support for this. earnie, good call for moving the email feature to a different issue!
I'll post a patch asap today.

JirkaRybka’s picture

Status: Needs work » Needs review
FileSize
8.75 KB
13.04 KB

I found a bit of time finally, so there's the patch with all error messages centralized in one function. So this gives us just one instance of these to maintain - I also used it for all other db-dead pages, which were quite similar: Apart from the actual error message (now passed into the new function), there was always something like 'see handbook or contact hosting provider' everywhere.

Error messages are only shown if 'show_errors' is on. (i.e. the bottom line will go away if 'show_errors' is off - see screenshot).

It also saves us quite a bit of code (also removed the MySQLi differentiation between two types of errors, as the resulting pages are the same now), and brings us consistency (HTML headers, 'show_errors' handling).

Tested on MySQL, and the MySQLi/PgSQL/unknown db type 'not supported' failures. Needs to be tested to *not* break other databases.

Anonymous’s picture

Status: Needs review » Needs work

The message should use DRUPAL_MINIMUM_[MY|PG]SQL to give the version to use.

JirkaRybka’s picture

Status: Needs work » Needs review
FileSize
12.99 KB

Unfortunately, that's impossible. These constants are defined in system.module, which is not available (bootstrap dies far before the module system initialized, with no database available); constants are undefined for us. Although it would be more or less possible to hardcode the path, and include system.module manually, I think that it would be definitely an overkill.

But otherwise you're quite right that the message (which I just pasted from existing code without substantial change) is now pretty outdated, speaking about version numbers far below the Drupal minimum. IMO, the version numbers are not necessary there - the message actually just says that the provided database type is not supported, and hints which ones would be ok; no need to elaborate further. After all, this error is most probably caused by a typo in a manual edit of settings.php (migrating the site to a different server), and the important information for db type selection is rather php-extension availability on the server (plus hosting provider's advice), and not primarily any research on version numbers.

So I just removed the version suggestions from that message.

keith.smith’s picture

A couple of very minor things now that I look at the new message in detail:

+  $message = '<p>The site is currently not available due to technical problems. Please try again later. Thank you for your understanding.</p>';
+  $message .= '<hr /><p><small>If you are the maintainer of this site, please check your database settings in the settings.php file, and whether your hosting provider\'s database server is running. For more help, see the <a href="http://drupal.org/node/258">handbook</a>, or contact your hosting provider.</small></p>';

How about this small change (the use of whether is a bit vague):

+  $message = '<p>The site is currently not available due to technical problems. Please try again later. Thank you for your understanding.</p>';
+  $message .= '<hr /><p><small>If you are the maintainer of this site, please check your database settings in the settings.php file and ensure that your hosting provider\'s database server is running. For more help, see the <a href="http://drupal.org/node/258">handbook</a>, or contact your hosting provider.</small></p>';
keith.smith’s picture

FileSize
13 KB

Never mind -- I should have just rolled a patch, 'tis just two words. (Please don't credit me for this, btw.)

JirkaRybka’s picture

Thanks a lot; as a non-native speaker, I just don't see these nuances at all...

scor’s picture

FileSize
13.51 KB

merges 2 calls to _db_error_page in database.mysql.inc
and fixes PHP.ini to php.ini

scor’s picture

FileSize
13.55 KB

pgsql generates Fatal error: Call to undefined function decode_entities() because drupal_maintenance_theme() is now called after decode_entities($php_errormsg).
this patch adds require_once './includes/unicode.inc' in database.pgsql.inc

JirkaRybka’s picture

#49 still applies cleanly, but needs someone to test and set RTBC if feeling so - this would be really good to have fixed in time for 6.0

Gábor Hojtsy’s picture

The patch looks good for commit, but would need some testing still for sure.

catch’s picture

Status: Needs review » Reviewed & tested by the community

Applies cleanly, tested with a mysql restart, works, much nicer :)

Since #49 fixed pgsql issues ought to be fine.

Gábor Hojtsy’s picture

Status: Reviewed & tested by the community » Fixed

Great, thanks, committed.

Anonymous’s picture

Status: Fixed » Closed (fixed)

Automatically closed -- issue fixed for two weeks with no activity.