[TikiWiki-commits] [Git][tikiwiki/tiki][master] [FIX] Emit correct HTTP status codes for fatal errors and login challenges

ushindi bienvenu pushed to branch master at Tiki Wiki CMS Groupware / Tiki


Commits:
da4c7a67 by Moïse Nturubika at 2026-07-21T22:57:15+00:00
[FIX] Emit correct HTTP status codes for fatal errors and login challenges
---
* [FIX] Restore challenge param: session alone misses curl/session_silent cases

* [FIX] Db errors: drop error_ref, action log already has full context

* [FIX] Address review: use session for login redirect, drop dead error_ref fallback

* [FIX] Feedback: drop redundant challenge param in errorAndDie redirect

* [FIX] Emit correct HTTP status codes for fatal errors and login challenges

See merge request tikiwiki/tiki!10663

- - - - -


6 changed files:

- db/tiki-db.php
- lib/core/Feedback.php
- lib/tikiaccesslib.php
- templates/database-connection-error.tpl
- tiki-login.php
- tiki-login_scr.php


Changes:

=====================================
db/tiki-db.php
=====================================
@@ -203,6 +203,7 @@ class TikiDbLegacyErrorHandler implements TikiDb_ErrorHandler
         if (defined('TIKI_CONSOLE')) {
             throw new ConsoleSetupException($msg, 1001);
         }
+        http_response_code(500);
         $smarty->display('database-connection-error.tpl');
         $this->log($msg . ' - ' . $q);
 


=====================================
lib/core/Feedback.php
=====================================
@@ -93,7 +93,9 @@ class Feedback
 
             $_SESSION['loginfrom'] = $_SERVER['REQUEST_URI'];
 
-            $access->redirect($url, $message, msgtype: 'error');
+            // Append ?challenge=1 so the final login page can emit 401 (the 302 itself cannot carry it).
+            $separator = str_contains($url, '?') ? '&' : '?';
+            $access->redirect($url . $separator . 'challenge=1', $message, msgtype: 'error');
             die;
         }
 


=====================================
lib/tikiaccesslib.php
=====================================
@@ -984,7 +984,13 @@ class TikiAccessLib extends TikiLib
                 && $tikiroot . $prefs['tikiIndex'] != $_SERVER['PHP_SELF']
                 && ( $page != $userlib->get_user_default_homepage($user) || $page === '' )
         ) {
-            $this->redirect($prefs['tikiIndex']);
+            // Append ?challenge=1 for auth errors so the login page can emit 401.
+            $redirectTarget = $prefs['tikiIndex'];
+            if (in_array($errortype, ['401', '403']) && ! $user) {
+                $separator = str_contains($redirectTarget, '?') ? '&' : '?';
+                $redirectTarget .= $separator . 'challenge=1';
+            }
+            $this->redirect($redirectTarget);
         }
 
         $detail = [


=====================================
templates/database-connection-error.tpl
=====================================
@@ -93,6 +93,20 @@
                 {else}
                     <h1>{tr}An error occurred while performing the request.{/tr}</h1>
                     <div class="wikitext" style="border: solid 1px #ccc; margin: 1em auto; padding: 1em; text-align: left; width: 90%;">
+                        {if $msg}
+                            <p><strong>{tr}Error type:{/tr}</strong>
+                            {if $msg|strstr:'Access denied'}
+                                {tr}Database permission error{/tr}
+                            {elseif $msg|strstr:'connect'}
+                                {tr}Database connection error{/tr}
+                            {elseif $msg|strstr:'doesn'}
+                                {tr}Database schema error (missing table or column){/tr}
+                            {else}
+                                {tr}Database query error{/tr}
+                            {/if}
+                            </p>
+                        {/if}
+                        <hr />
                         <p>Things to check:</p>
                         <ol class="fancylist">
                             <li><p>Did you complete the <a href="tiki-install.php">Tiki Installer?</a></p></li>


=====================================
tiki-login.php
=====================================
@@ -43,6 +43,11 @@ if (empty($_POST['user'])) {
 require_once('tiki-setup.php');
 global $prefs;
 
+// Emit 401 when reached via an auth challenge (via ?challenge=1 param or session loginfrom).
+if (! $user && (! empty($_GET['challenge']) || ! empty($_SESSION['loginfrom']))) {
+    http_response_code(401);
+}
+
 $headerlib = TikiLib::lib('header');
 $headerlib->addSecurityHeaders();
 
@@ -66,10 +71,12 @@ if (! empty($_REQUEST['code']) && $prefs['auth_method'] == 'openid_connect' && T
     $login_url_params = '?cas=y';
     $_REQUEST['user'] = '';
 } elseif ($prefs['twoFactorAuth'] === 'n' && (! isset($_REQUEST['user']) or isset($_REQUEST['username'])) && empty($_REQUEST['su'])) {
+    // Preserve ?challenge=1 so tiki-login_scr.php can emit 401 for monitoring tools.
+    $loginScrParams = ! empty($_GET['challenge']) ? '?challenge=1' : '';
     if (! $https_mode && $prefs['https_login'] == 'required') {
-        header('Location: ' . $base_url_https . 'tiki-login_scr.php');
+        header('Location: ' . $base_url_https . 'tiki-login_scr.php' . $loginScrParams);
     } else {
-        header('Location: ' . $base_url . 'tiki-login_scr.php');
+        header('Location: ' . $base_url . 'tiki-login_scr.php' . $loginScrParams);
     }
     die;
 }


=====================================
tiki-login_scr.php
=====================================
@@ -26,6 +26,10 @@ $inputConfiguration = [
 ];
 include_once("tiki-setup.php");
 
+// Emit 401 when reached via an auth challenge (via ?challenge=1 param or session loginfrom).
+if (! $user && (! empty($_GET['challenge']) || ! empty($_SESSION['loginfrom']))) {
+    http_response_code(401);
+}
 
 // Setup Two-Factor Auth form state
 $showTwoFactorForm = $prefs['twoFactorAuth'];



View it on GitLab: https://gitlab.com/tikiwiki/tiki/-/commit/da4c7a67088057a70e7365b2c9906d9cef442d85

-- 
View it on GitLab: https://gitlab.com/tikiwiki/tiki/-/commit/da4c7a67088057a70e7365b2c9906d9cef442d85
You're receiving this email because of your account on gitlab.com. Manage all notifications: https://gitlab.com/-/profile/notifications | Help: https://gitlab.com/help

_______________________________________________
TikiWiki-cvs mailing list
[email protected]
https://lists.sourceforge.net/lists/listinfo/tikiwiki-cvs