From cb3f2632a968826a0207daa0718573fb01f24c14 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Michal=20=C4=8Ciha=C5=99?= Date: Fri, 2 Sep 2016 14:23:35 +0200 Subject: [PATCH 1/5] Properly escape session startup errors MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Signed-off-by: Michal Čihař --- libraries/session.inc.php | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/libraries/session.inc.php b/libraries/session.inc.php index f1e6370df5..d83f3c969a 100644 --- a/libraries/session.inc.php +++ b/libraries/session.inc.php @@ -88,7 +88,7 @@ function PMA_sessionFailed($errors) $messages[] = preg_replace( '/open(.*, O_RDWR)/', 'open(SESSION_FILE, O_RDWR)', - $error->getMessage() + htmlspecialchars($error->getMessage()) ); } From 2251ca21c0c538e4f24bda47be02179845fa0b8a Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Michal=20=C4=8Ciha=C5=99?= Date: Fri, 2 Sep 2016 14:25:04 +0200 Subject: [PATCH 2/5] Fix regexp for file path cleanup MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Signed-off-by: Michal Čihař --- libraries/session.inc.php | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/libraries/session.inc.php b/libraries/session.inc.php index d83f3c969a..71bd614d0a 100644 --- a/libraries/session.inc.php +++ b/libraries/session.inc.php @@ -86,7 +86,7 @@ function PMA_sessionFailed($errors) * will not change in future. */ $messages[] = preg_replace( - '/open(.*, O_RDWR)/', + '/open\(.*, O_RDWR\)/', 'open(SESSION_FILE, O_RDWR)', htmlspecialchars($error->getMessage()) ); From eb3e3b73c34d7b6916a541f8eae08167b49ae455 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Michal=20=C4=8Ciha=C5=99?= Date: Fri, 2 Sep 2016 14:32:00 +0200 Subject: [PATCH 3/5] Simplified handling of connection errors MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit There is no need to retrigger errors, just let the handler know to handle them without backtrace. Signed-off-by: Michal Čihař --- libraries/DatabaseInterface.php | 15 +++------------ libraries/Error.php | 21 +++++++++++++++++++-- libraries/ErrorHandler.php | 18 ++++++++++++++++++ 3 files changed, 40 insertions(+), 14 deletions(-) diff --git a/libraries/DatabaseInterface.php b/libraries/DatabaseInterface.php index e4c3ed5026..8f66fb3b40 100644 --- a/libraries/DatabaseInterface.php +++ b/libraries/DatabaseInterface.php @@ -2351,21 +2351,12 @@ class DatabaseInterface $user, $password, $is_controluser = false, $server = null, $auxiliary_connection = false ) { - $error_count = $GLOBALS['error_handler']->countErrors(); + // Do not show location and backtrace for connection errors + $error_count = $GLOBALS['error_handler']->setHideLocation(true); $result = $this->_extension->connect( $user, $password, $is_controluser, $server, $auxiliary_connection ); - - /* Any errors from connection? */ - if ($GLOBALS['error_handler']->countErrors() > $error_count) { - $errors = $GLOBALS['error_handler']->sliceErrors($error_count); - foreach ($errors as $error) { - trigger_error( - $error->getMessage(), - E_USER_ERROR - ); - } - } + $error_count = $GLOBALS['error_handler']->setHideLocation(false); if ($result) { if (! $auxiliary_connection && ! $is_controluser) { diff --git a/libraries/Error.php b/libraries/Error.php index 6548877c60..811b504031 100644 --- a/libraries/Error.php +++ b/libraries/Error.php @@ -83,6 +83,11 @@ class Error extends Message */ protected $backtrace = array(); + /** + * Hide location of errors + */ + protected $hide_location = false; + /** * Constructor * @@ -146,6 +151,18 @@ class Error extends Message return $result; } + /** + * Toggles location hiding + * + * @param boolean $hide Whether to hide + * + * @return void + */ + public function setHideLocation($hide) + { + $this->hide_location = $hide; + } + /** * sets PMA\libraries\Error::$_backtrace * @@ -416,13 +433,13 @@ class Error extends Message { $this->isDisplayed(true); $retval = '
'; - if (! $this->isUserError()) { + if (! $this->isUserError() && ! $this->hide_location) { $retval .= '' . $this->getType() . ''; $retval .= ' in ' . $this->getFile() . '#' . $this->getLine(); $retval .= "
\n"; } $retval .= $this->getMessage(); - if (! $this->isUserError()) { + if (! $this->isUserError() && ! $this->hide_location) { $retval .= "
\n"; $retval .= "
\n"; $retval .= "Backtrace
\n"; diff --git a/libraries/ErrorHandler.php b/libraries/ErrorHandler.php index 8bd408d5a1..0e96f8e026 100644 --- a/libraries/ErrorHandler.php +++ b/libraries/ErrorHandler.php @@ -23,6 +23,11 @@ class ErrorHandler */ protected $errors = array(); + /** + * Hide location of errors + */ + protected $hide_location = false; + /** * Constructor - set PHP error handler * @@ -77,6 +82,18 @@ class ErrorHandler } } + /** + * Toggles location hiding + * + * @param boolean $hide Whether to hide + * + * @return void + */ + public function setHideLocation($hide) + { + $this->hide_location = $hide; + } + /** * returns array with all errors * @@ -170,6 +187,7 @@ class ErrorHandler $errfile, $errline ); + $error->setHideLocation($this->hide_location); // do not repeat errors $this->errors[$error->getHash()] = $error; From 829d51c9dd34f53e90a8f4ec0afc9e985844556c Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Michal=20=C4=8Ciha=C5=99?= Date: Fri, 2 Sep 2016 14:38:52 +0200 Subject: [PATCH 4/5] Treat hide_location error as user ones MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Signed-off-by: Michal Čihař --- libraries/Error.php | 7 ++++--- 1 file changed, 4 insertions(+), 3 deletions(-) diff --git a/libraries/Error.php b/libraries/Error.php index 811b504031..b45afef75a 100644 --- a/libraries/Error.php +++ b/libraries/Error.php @@ -433,13 +433,13 @@ class Error extends Message { $this->isDisplayed(true); $retval = '
'; - if (! $this->isUserError() && ! $this->hide_location) { + if (! $this->isUserError()) { $retval .= '' . $this->getType() . ''; $retval .= ' in ' . $this->getFile() . '#' . $this->getLine(); $retval .= "
\n"; } $retval .= $this->getMessage(); - if (! $this->isUserError() && ! $this->hide_location) { + if (! $this->isUserError()) { $retval .= "
\n"; $retval .= "
\n"; $retval .= "Backtrace
\n"; @@ -458,7 +458,8 @@ class Error extends Message */ public function isUserError() { - return $this->getNumber() & (E_USER_WARNING | E_USER_ERROR | E_USER_NOTICE); + return $this->hide_location || + ($this->getNumber() & (E_USER_WARNING | E_USER_ERROR | E_USER_NOTICE)); } /** From e01f40480445d56bc7ae4572f50d9dbba5f28546 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Michal=20=C4=8Ciha=C5=99?= Date: Fri, 2 Sep 2016 14:40:18 +0200 Subject: [PATCH 5/5] Remove unused variable MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Signed-off-by: Michal Čihař --- libraries/DatabaseInterface.php | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/libraries/DatabaseInterface.php b/libraries/DatabaseInterface.php index 8f66fb3b40..600b473687 100644 --- a/libraries/DatabaseInterface.php +++ b/libraries/DatabaseInterface.php @@ -2352,11 +2352,11 @@ class DatabaseInterface $auxiliary_connection = false ) { // Do not show location and backtrace for connection errors - $error_count = $GLOBALS['error_handler']->setHideLocation(true); + $GLOBALS['error_handler']->setHideLocation(true); $result = $this->_extension->connect( $user, $password, $is_controluser, $server, $auxiliary_connection ); - $error_count = $GLOBALS['error_handler']->setHideLocation(false); + $GLOBALS['error_handler']->setHideLocation(false); if ($result) { if (! $auxiliary_connection && ! $is_controluser) {