{"action":"created","issue":{"url":"https://api.github.com/repos/contao/core-bundle/issues/1422","repository_url":"https://api.github.com/repos/contao/core-bundle","labels_url":"https://api.github.com/repos/contao/core-bundle/issues/1422/labels{/name}","comments_url":"https://api.github.com/repos/contao/core-bundle/issues/1422/comments","events_url":"https://api.github.com/repos/contao/core-bundle/issues/1422/events","html_url":"https://github.com/contao/core-bundle/issues/1422","id":304445829,"number":1422,"title":"Error Massage showes DB Connection Parameter (host, user, password) in the frontend","user":{"login":"jommbee","id":4679889,"avatar_url":"https://avatars3.githubusercontent.com/u/4679889?v=4","gravatar_id":"","url":"https://api.github.com/users/jommbee","html_url":"https://github.com/jommbee","followers_url":"https://api.github.com/users/jommbee/followers","following_url":"https://api.github.com/users/jommbee/following{/other_user}","gists_url":"https://api.github.com/users/jommbee/gists{/gist_id}","starred_url":"https://api.github.com/users/jommbee/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/jommbee/subscriptions","organizations_url":"https://api.github.com/users/jommbee/orgs","repos_url":"https://api.github.com/users/jommbee/repos","events_url":"https://api.github.com/users/jommbee/events{/privacy}","received_events_url":"https://api.github.com/users/jommbee/received_events","type":"User","site_admin":false},"labels":[],"state":"open","locked":false,"assignee":null,"assignees":[],"milestone":null,"comments":0,"created_at":"2018-03-12T16:30:30Z","updated_at":"2018-03-12T21:47:14Z","closed_at":null,"author_association":"NONE","body":"Contao 4.4.16\r\n\r\nFollowing Error Massage was showen in the frontend:\r\n\r\n```\r\nFatal error: Uncaught PDOException: SQLSTATE[HY000] [2002] No such file or directory in \r\n/www/XXX/vendor/doctrine/dbal/lib/Doctrine/DBAL/Driver/PDOConnection.php:43 Stack trace: #0 \r\n/www/XXX/vendor/doctrine/dbal/lib/Doctrine/DBAL/Driver/PDOConnection.php(43): PDO->__construct\r\n('mysql:host=HOST, 'USER', 'PASSWORT', Array) #1 \r\n/www/XXX/vendor/doctrine/dbal/lib/Doctrine/DBAL/Driver/PDOMySql/Driver.php(44): Doctrine\\DBAL\\Driver\r\n\\PDOConnection->__construct('mysql:host=HOST', 'USER', 'PASSWORT', Array) #2 \r\n/www/XXX/vendor/doctrine/dbal/lib/Doctrine/DBAL/Connection.php(372): Doctrine\\DBAL\\Driver\\PDOMySql\\Driver->connect(Array, 'USER', 'PASSWORT', Array) #3 \r\n/www/XXX/vendor/doctrine/dbal/lib/Doctrine/DBAL/Connection.php(432): Doctrine\\DBAL\\Connection->connect() #4 /www/XXX in /www/XXX/vendor/doctrine/doctrine-bundle/ConnectionFactory.php on line \r\n96\r\n```\r\nLuckily in a password-protected environment. On a live page, this would be a disaster.\r\n\r\nError Messages log file:\r\n\r\n`[2018-03-12 17:11:44] request.CRITICAL: Uncaught PHP Exception Doctrine\\DBAL\\DBALException: \"An exception occured while establishing a connection to figure out your platform version. You can circumvent this by setting a 'server_version' configuration value  For further information have a look at: https://github.com/doctrine/DoctrineBundle/issues/673\" at /www/XXX/vendor/doctrine/doctrine-bundle/ConnectionFactory.php line 96 {\"exception\":\"[object] (Doctrine\\\\DBAL\\\\DBALException(code: 0): An exception occured while establishing a connection to figure out your platform version.\\nYou can circumvent this by setting a 'server_version' configuration value\\n\\nFor further information have a look at:\\nhttps://github.com/doctrine/DoctrineBundle/issues/673 at /www/XXX/vendor/doctrine/doctrine-bundle/ConnectionFactory.php:96, Doctrine\\\\DBAL\\\\Exception\\\\ConnectionException(code: 0): An exception occurred in driver: SQLSTATE[HY000] [2002] No such file or directory at /www/XXX/vendor/doctrine/dbal/lib/Doctrine/DBAL/Driver/AbstractMySQLDriver.php:108, Doctrine\\\\DBAL\\\\Driver\\\\PDOException(code: 2002): SQLSTATE[HY000] [2002] No such file or directory at /www/XXX/vendor/doctrine/dbal/lib/Doctrine/DBAL/Driver/PDOConnection.php:47, PDOException(code: 2002): SQLSTATE[HY000] [2002] No such file or directory at /www/XXX/vendor/doctrine/dbal/lib/Doctrine/DBAL/Driver/PDOConnection.php:43)\"} []`\r\n\r\n`[2018-03-12 17:11:44] request.CRITICAL: Exception thrown when handling an exception (Doctrine\\DBAL\\DBALException: An exception occured while establishing a connection to figure out your platform version. You can circumvent this by setting a 'server_version' configuration value  For further information have a look at: https://github.com/doctrine/DoctrineBundle/issues/673 at /www/XXX/vendor/doctrine/doctrine-bundle/ConnectionFactory.php line 96) {\"exception\":\"[object] (Doctrine\\\\DBAL\\\\DBALException(code: 0): An exception occured while establishing a connection to figure out your platform version.\\nYou can circumvent this by setting a 'server_version' configuration value\\n\\nFor further information have a look at:\\nhttps://github.com/doctrine/DoctrineBundle/issues/673 at /www/XXX/vendor/doctrine/doctrine-bundle/ConnectionFactory.php:96, Doctrine\\\\DBAL\\\\Exception\\\\ConnectionException(code: 0): An exception occurred in driver: SQLSTATE[HY000] [2002] No such file or directory at /www/XXX/vendor/doctrine/dbal/lib/Doctrine/DBAL/Driver/AbstractMySQLDriver.php:108, Doctrine\\\\DBAL\\\\Driver\\\\PDOException(code: 2002): SQLSTATE[HY000] [2002] No such file or directory at /www/XXX/vendor/doctrine/dbal/lib/Doctrine/DBAL/Driver/PDOConnection.php:47, PDOException(code: 2002): SQLSTATE[HY000] [2002] No such file or directory at /www/XXX/vendor/doctrine/dbal/lib/Doctrine/DBAL/Driver/PDOConnection.php:43)\"} []`\r\n\r\n\r\n"},"comment":{"url":"https://api.github.com/repos/contao/core-bundle/issues/comments/372473926","html_url":"https://github.com/contao/core-bundle/issues/1422#issuecomment-372473926","issue_url":"https://api.github.com/repos/contao/core-bundle/issues/1422","id":372473926,"user":{"login":"CMSworker","id":31544192,"avatar_url":"https://avatars2.githubusercontent.com/u/31544192?v=4","gravatar_id":"","url":"https://api.github.com/users/CMSworker","html_url":"https://github.com/CMSworker","followers_url":"https://api.github.com/users/CMSworker/followers","following_url":"https://api.github.com/users/CMSworker/following{/other_user}","gists_url":"https://api.github.com/users/CMSworker/gists{/gist_id}","starred_url":"https://api.github.com/users/CMSworker/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/CMSworker/subscriptions","organizations_url":"https://api.github.com/users/CMSworker/orgs","repos_url":"https://api.github.com/users/CMSworker/repos","events_url":"https://api.github.com/users/CMSworker/events{/privacy}","received_events_url":"https://api.github.com/users/CMSworker/received_events","type":"User","site_admin":false},"created_at":"2018-03-12T21:47:13Z","updated_at":"2018-03-12T21:47:13Z","author_association":"NONE","body":"Unfortunately I can confirm this security issue.\r\n\r\nTested with Contao 4.4.16 on XMAPP: Just deactivate MySQL in the XAMPP Controll Panel and try to load the website: database username and passwort are shown in the error message.\r\n\r\nNotification core developers @leofeyer @Toflar @ausi @aschempp"}}
{"actor":{"display_login":"CMSworker"}}