DB connection failure leaks raw mysqli error text to any unauthenticated visitor #104

New Issue

2026-09-01T00:21:12-04:00

jared commented

2026-09-01 00:21:12 -04:00

Severity: Medium

index.php (~lines 27-29): die("Connection failed: " . $conn->connect_error); runs before any auth/routing, on literally any non-API page load.

mysqli::$connect_error typically includes the DB host, username, or specific failure reason (e.g. "Access denied for user 'X'@'Y' (using password: YES)", "Unknown database 'Z'", "Can't connect to MySQL server on 'host' (errno)"). No error_log() call and no styled error page either — a bare die() with no logging trail.

Fix: Catch this, log via error_log(), and render a generic styled error page (see related '' issue for the app's missing 500 page) instead of echoing the raw driver error string to the visitor.

**Severity:** Medium `index.php` (~lines 27-29): `die("Connection failed: " . $conn->connect_error);` runs before any auth/routing, on literally any non-API page load. `mysqli::$connect_error` typically includes the DB host, username, or specific failure reason (e.g. "Access denied for user 'X'@'Y' (using password: YES)", "Unknown database 'Z'", "Can't connect to MySQL server on 'host' (errno)"). No `error_log()` call and no styled error page either — a bare `die()` with no logging trail. **Fix:** Catch this, log via `error_log()`, and render a generic styled error page (see related '' issue for the app's missing 500 page) instead of echoing the raw driver error string to the visitor.

jared added the priority/medium security labels 2026-09-08 10:15:50 -04:00

jared referenced this issue from a commit

2026-09-11 11:43:00 -04:00

Route index.php and create_ticket_api.php through Database::getConnection() (#103, #104)

jared referenced this issue from a commit

2026-09-11 11:54:37 -04:00

Merge development into main: connection/security hardening batch (#85, #94, #103, #104)

jared commented

2026-09-11 11:54:45 -04:00

Fixed and verified against real MariaDB and real running endpoints (session-based CSRF flow, health-check states, connection charset/timezone sync). Merged to main in commit bcc732e.

Fixed and verified against real MariaDB and real running endpoints (session-based CSRF flow, health-check states, connection charset/timezone sync). Merged to main in commit bcc732e.

jared closed this issue

2026-09-11 11:54:45 -04:00

Sign in to join this conversation.

1 Participants

Notifications

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: LotusGuild/tinker_tickets#104