Tickets :: Comment on [#5101] horde disclosure of DB connection string in error message

* Your Email Address
* Spam protection	Enter the letters below: __.. ..__ .__ . (__ \|\/\|[__)[__) \| .__)\| \|\| \[__)\__\|
Comment	> Maybe this should be in enhancement... but... if Horde encounters a > fatal error, it sends a print_r() of the DB object to the browser. > It exposes the database connection information for all the world to > see, and that's a terrible thing to do. > > > > A fatal error has occurred > > DB Error: connect failed > > > > [line 90 of > /usr/local/projects/webmail/html-dev/horde/ingo/lib/Storage/sql.php] > > Details (also in Horde's logfile): > > > > object(DB_Error)#22 (8) { > > ["error_message_prefix"]=> > > ... > > ["dsn"]=> > > array(13) { > > ["phptype"]=> > > string(5) "mysql" > > ["dbsyntax"]=> > > string(5) "mysql" > > ["username"]=> > > string(5) "horde" > > ["password"]=> > > string(9) "L3tM3In!" > > ["protocol"]=> > > string(3) "tcp" > > ["hostspec"]=> > > string(24) "mysql.example.com" > > ["port"]=> > >
Attachment
Watch this ticket