Req #51428 [Opn->Bgs]: new PDO is spitting out the password/username for all to see on error.

Edit report at http://bugs.php.net/bug.php?id=51428&edit=1

 ID:          51428
 Updated by:  [email protected]
 Reported by: pBakhuis at Gmail dot com
 Summary:     new PDO is spitting out the password/username for all to
              see on error.
-Status:      Open
+Status:      Bogus
 Type:        Feature/Change Request
 Package:     PostgreSQL related
 PHP Version: 5.2.13

 New Comment:

Thank you for taking the time to write to us, but this is not
a bug. Please double-check the documentation available at
http://www.php.net/manual/ and the instructions on how to report
a bug at http://bugs.php.net/how-to-report.php

Catch your errors properly never show PHP errors to users.


Previous Comments:
------------------------------------------------------------------------
[2010-03-29 17:58:30] pBakhuis at Gmail dot com

Description:
------------
Despite using the code as provided in the 'test script field', if the
creation of the PDO object fails it shows both the username and
password.


Fatal error: Uncaught exception 'PDOException' with message 'could not
find driver' in C:\Program Files\BitNami
WAPPStack\apache2\htdocs\cb.php:12 Stack trace: #0 C:\Program
Files\BitNami WAPPStack\apache2\htdocs\cb.php(12):
PDO->__construct('pgsql:dbname=an...', 'someUsername', 'somePassword')
#1 {main} thrown in C:\Program Files\BitNami
WAPPStack\apache2\htdocs\cb.php  on line 12

So the first 2 letters of the database are visible along with the
complete username and password. They hardly add anything of value to the
error itself but pose quite the security risk if you have error
reporting enabled on a production server.


Test script:
---------------
$settings = array(
  'database' => 'anAaa',
  'host'     => 'localhost',
  'username' => 'someUsername',
  'password' => 'somePassword'
);

$db = new PDO(
	  sprintf(
	    'pgsql:dbname=%s;host=%s',
	    $settings['database'],
	    $settings['host']
	  ),
	  $settings['username'],
	  $settings['password']
	);[/code]



------------------------------------------------------------------------



-- 
Edit this bug report at http://bugs.php.net/bug.php?id=51428&edit=1