By ckclarke on

A couple of days ago I flagged what was, I thought, a fairly significant problem with Drupal core. I submitted at first as a support request, but when a couple of days went by and I could see it getting buried in other bug reports, I resubmitted it as a bug.

Today, it looks like both submissions have been summarily deleted from the issue review queue.

The bug/issue was this: when my host rebooted my database server, my site was temporarily unable to connect to the database.

Drupal displayed a page which said, unable to connect to database, which on it's own was fine. But it also printed the IP of the database AND my username on the screen. This screen would have been viewable by anyone trying to access my site at that moment. I'm using 4.7 and I had the configuration set to write errors to log, not to screen.

Now if this was something that was my fault somehow, fine, let me know what I did wrong. Otherwise, though, I think this is a fairly major issue as software should not be handing out that sort of information to the general public.

⋅ Categories: Drupal 4.7.x

Comments

heine’s picture

heine commented

It was marked "won't fix"

http://drupal.org/node/62098
http://drupal.org/node/61648

--
Tips for posting to the forums.
When your problem is solved, please post a follow-up to the thread you started.

ckclarke’s picture

ckclarke commented

Heine, first, thanks for telling me how to change the category. I didn't want to double post, but didn't want the issue to be buried.

Your comment was far more useful than CHX's approach, which was to chastize me like some unruly child.

Also, ahem, less than helpful was CHXs comment that my database should be protected by firewalls and passwords. Well no kidding, thanks for that.

But all the protection in the world is fairly useless if the software is giving away information it shouldn't be.

So again, I ask, what can be done to fix this?

heine’s picture

heine commented

You are welcome. The issues queue's view & sorting can be a bit confusing.

I think it's best to keep the discussion at http://drupal.org/node/62098

--
Tips for posting to the forums.
When your problem is solved, please post a follow-up to the thread you started.

ckclarke’s picture

ckclarke commented

So I'll leave off here and watch the issue there. Thanks!

drubeedoo’s picture

drubeedoo commented

What could be done about it is that someone knowledgeable about this particular area of Drupal comes around to see your point of view and writes a patch. If you are knowledgeable in the workings of Drupal, you could do the same. IMHO, I'd stick to the issue (which has merit) and put my feelings aside. What's done is done.

I opened the bug report to keep it on the radar: http://drupal.org/node/62098.

drubeedoo’s picture

drubeedoo commented

I agree that Drupal error messages should not reveal user names, database names, IP address of the db server, or internal file paths on the server.

I'm OK with a cryptic:

We apologize, but we cannot connect to the database at this time. Either the database server is unavailable, or there is a problem with the database URL setting.

If more information is warranted (maybe for testing), then it could be solved by setting a boolean value in settings.php and checking the value when writing all error messages that may have sensitive information. The default would be minimal information.