[geeklog-devel] [geeklog-cvs] Geeklog-1.x/system lib-database.php, 1.48, 1.49

[Joe Mucchiello]

Shouldn't that be

             if (SEC_inGroup('Root')) {
                 die ($result);
             } else {
                 die ('An SQL error has occurred. Please see 
error.log for details.');
             }

It's not a good idea to expose database error information to normal 
users. In fact mentioning the error.log is somewhat weird too. The 
error message should probably be something like:

                 die ('A database error has occurred. An error 
message has be sent to the administrator.');

At 09:52 PM 10/10/2007, Oliver wrote:

>*** lib-database.php    11 Sep 2007 03:26:50 -0000      1.48

>--- lib-database.php    11 Oct 2007 01:52:37 -0000      1.49

>***************

>*** 184,189 ****

>                   $errmsg .= LB . $db . ': ' . $request;

>               }

>!             COM_errorLog ($errmsg);

>!             die ('An SQL error has occurred. Please see error.log 

>for details.');

>           }

>       }

>--- 184,189 ----

>                   $errmsg .= LB . $db . ': ' . $request;

>               }

>!             $result = COM_errorLog ($errmsg, 3);

>!             die ($result);

>           }

>       }

>

>_______________________________________________

>geeklog-cvs mailing list

>geeklog-cvs at lists.geeklog.net

>http://eight.pairlist.net/mailman/listinfo/geeklog-cvs


----
Joe Mucchiello
Throwing Dice Games
http://www.throwingdice.com