DB connection failure leaks raw mysqli error text to any unauthenticated visitor #104

New Issue

2026-09-01T00:21:12-04:00

jared commented

2026-09-01 00:21:12 -04:00

Severity: Medium

index.php (~lines 27-29): die("Connection failed: " . $conn->connect_error); runs before any auth/routing, on literally any non-API page load.

mysqli::$connect_error typically includes the DB host, username, or specific failure reason (e.g. "Access denied for user 'X'@'Y' (using password: YES)", "Unknown database 'Z'", "Can't connect to MySQL server on 'host' (errno)"). No error_log() call and no styled error page either — a bare die() with no logging trail.

Fix: Catch this, log via error_log(), and render a generic styled error page (see related '' issue for the app's missing 500 page) instead of echoing the raw driver error string to the visitor.

**Severity:** Medium `index.php` (~lines 27-29): `die("Connection failed: " . $conn->connect_error);` runs before any auth/routing, on literally any non-API page load. `mysqli::$connect_error` typically includes the DB host, username, or specific failure reason (e.g. "Access denied for user 'X'@'Y' (using password: YES)", "Unknown database 'Z'", "Can't connect to MySQL server on 'host' (errno)"). No `error_log()` call and no styled error page either — a bare `die()` with no logging trail. **Fix:** Catch this, log via `error_log()`, and render a generic styled error page (see related '' issue for the app's missing 500 page) instead of echoing the raw driver error string to the visitor.

jared added the priority/medium security labels 2026-09-08 10:15:50 -04:00

Sign in to join this conversation.

1 Participants

Notifications

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: LotusGuild/tinker_tickets#104