Osclass Support Forums
General osclass questions => General discussion => Topic started by: dsf on October 18, 2022, 09:58:46 PM
-
Hi,
Our db was down for an hour or two and this came up:
PHP Fatal error: Uncaught Error: Call to undefined function mysqli_report() in /home/oc-includes/osclass/classes/database/DBConnectionClass.php:464
Thanks
-
Sounds reasonable when db is not reachable at that time. Did you get error on live site or in debug?
-
In debug.log , i have no idea if the visitors also saw that. And of cource it is reasonable.
But not with the error i posted. Fatal php error with some function that doesn't exist.
-
Are you using a server?
Try to restart MySQL or see if you have the mysql (mysql and mysqli) extension installed in your PHP version.
-
Are you using a server?
Try to restart MySQL or see if you have the MySQL extension installed in your PHP version.
Guys please.
Let the developer just give a reply and if something could be improved or not.
-
Are you using a server?
Try to restart MySQL or see if you have the MySQL extension installed in your PHP version.
Guys please.
Let the developer just give a reply and if something could be improved or not.
Why do you think this is called “support forums” ? So anyone in community can try help you. It’s a public forum. If you need just developers support then you can open a private ticket but anyway that error is very known due to PHP MySQL server related not just osclasspoint.
-
File home/oc-includes/osclass/classes/database/DBConnectionClass.php is your connection to your database file. Since your db is back up why worrie about it. A normal error in a bad db situation.... Sit back and relax
-
Also checking better the debug.log, i see the NAME and FULL PASSWORD of the database of the site. In the stack trace.
#0 /home/oc-includes/osclass/classes/database/DBConnectionClass.php(272): DBConnectionClass->_connectToDb('localhost', 'fulledbname...'passwordhere', NULL)
I can't believe my eyes this is happening. The password revealed in a public log file (if you know where to look).
-
File home/oc-includes/osclass/classes/database/DBConnectionClass.php is your connection to your database file. Since your db is back up why worrie about it. A normal error in a bad db situation.... Sit back and relax
Sure, i hope the error doesn't display publicly and probably could be catched.
-
Also checking better the debug.log, i see the NAME and FULL PASSWORD of the database of the site. In the stack trace.
#0 /home/oc-includes/osclass/classes/database/DBConnectionClass.php(272): DBConnectionClass->_connectToDb('localhost', 'fulledbname...'passwordhere', NULL)
I can't believe my eyes this is happening. The password revealed in a public log file (if you know where to look).
The DB debug log is only visible to you when you are logged in as administrator, other users don't see it. If you want to try, just log in as admin with chrome and then surf your website as visitor or login as user using Chrome in Incognito mode or with a different browser.
-
Also checking better the debug.log, i see the NAME and FULL PASSWORD of the database of the site. In the stack trace.
#0 /home/oc-includes/osclass/classes/database/DBConnectionClass.php(272): DBConnectionClass->_connectToDb('localhost', 'fulledbname...'passwordhere', NULL)
I can't believe my eyes this is happening. The password revealed in a public log file (if you know where to look).
The DB debug log is only visible to you when you are logged in as administrator, other users don't see it. If you want to try, just log in as admin with chrome and then surf your website as visitor or login as user using Chrome in Incognito mode or with a different browser.
Everyone can see the debug . log if he points his browser to /oc-content/debug.log.
Same for Wordpress (wp-content/debug.log).
-
@dsf
For me it works, generated if you set osclass to save logs into file.
-
@dsf
For me it works, generated if you set osclass to save logs into file.
What do you mean, i do not understand your reply.
-
Debug file is created
-
@dsf
If you enable the debug log in config file yes it creates debug.log file for you to find errors.
Disable in config and file is not generated anymore..... Clear or delete log file after you are done debugging and no info is shown to others who are interested in reading the file.
-
Debug file is created
I never said it wasn't created.
I asked
1. PHP Fatal error: Uncaught Error: Call to undefined function mysqli_report(). What is that?
2. WHY full db name and password are revealed in debug.log, a file publicly available if debug log is enabled.
Just tested the (1) and it seems that fortunately the visitors in case of an issue with the db, do not get the full error of (1) but a generic notice. And that is good.
-
@dsf
If you enable the debug log in config file yes it creates debug.log file for you to find errors.
Disable in config and file is not generated anymore..... Clear or delete log file after you are done debugging and no info is shown to others who are interested in reading the file.
Good explanation and debug logs shouldn’t be enabled in production states and kept enabled. It should only be left on when to gather clues to identify issues occurred on website then disabled.
Plaintext passwords should never be exposed in debug logs so this needs to be fixed by your hosting provider not osclasspoint. Issue with your MySQL extension going down which signals that your database is trying to connect.
-
Because nobody is giving you a clear answer, here you go.
The error is most likely caused by the hosting environment, i.e. your webhost had a hiccup (lag, PHP crash etc.), and the MySQLi PHP extension became inaccessible.
If it happens again, check with your hosting company, or move to a better host.
PS: Debug should never be run in production.
Good luck!
-
Plaintext passwords should never be exposed in debug logs so this needs to be fixed by your hosting provider not osclasspoint.
My hosting provider? For a file created from Osclass script (stack trace)? Dude, you have no idea what you are talking about, sorry. No pun intended but clearly you have no experience in all this.
-
The error is most likely caused by the hosting environment, i.e. your webhost had a hiccup (lag, PHP crash etc.), and the MySQLi PHP extension became inaccessible.
PS: Debug should never be run in production.
Well, i have upgraded 12 Osclass sites so far from an other release. I work as a freelancer for support to hosting companies, mainly Wordpress and some Osclass.
Debug log is enabled for a while, since the upgrade from other release was hard to do, some db changes were applied and we must monitor customers sites for a while.
So all in all, nothing to do with hosting as you suggest. If any hiccup exists, it is from the script and nothing else.
For now, we had to block all ".log" files from public view, using .htaccess.
-
Plaintext passwords should never be exposed in debug logs so this needs to be fixed by your hosting provider not osclasspoint.
My hosting provider? For a file created from Osclass script (stack trace)? Dude, you have no idea what you are talking about, sorry. No pun intended but clearly you have no experience in all this.
Mate, I run 8 servers and 2 businesses with one of them gaining 16k daily visitors according to analytics and earning me 6k gbp per month and you’re telling me I have no clue😂. How come this issue isn’t showing on one of my classified ads sites in debug logs it’s only showing for you. Sloppy webmaster or very bad hosting provider you have so you pick. Yes it’s from osclasspoint trying to connect to the MySQL extension when it goes down and nothing else and the script is failed to connect as quoted by previous user.
-
Plaintext passwords should never be exposed in debug logs so this needs to be fixed by your hosting provider not osclasspoint.
My hosting provider? For a file created from Osclass script (stack trace)? Dude, you have no idea what you are talking about, sorry. No pun intended but clearly you have no experience in all this.
Mate, I run 8 servers and 2 businesses with one of them gaining 16k daily visitors according to analytics and earning me 6k gbp per month and you’re telling me I have no clue😂. How come this issue isn’t showing on one of my classified ads sites in debug logs it’s only showing for you. Sloppy webmaster or very bad hosting provider you have so you pick. Yes it’s from osclasspoint trying to connect to the MySQL extension when it goes down nothing and the script is trying to connect as quoted by previous user me
He was talking about me.
Again, good luck mr. Expert! ;)
-
Plaintext passwords should never be exposed in debug logs so this needs to be fixed by your hosting provider not osclasspoint.
My hosting provider? For a file created from Osclass script (stack trace)? Dude, you have no idea what you are talking about, sorry. No pun intended but clearly you have no experience in all this.
Mate, I run 8 servers and 2 businesses with one of them gaining 16k daily visitors according to analytics and earning me 6k gbp per month and you’re telling me I have no clue😂. How come this issue isn’t showing on one of my classified ads sites in debug logs it’s only showing for you. Sloppy webmaster or very bad hosting provider you have so you pick. Yes it’s from osclasspoint trying to connect to the MySQL extension when it goes down nothing and the script is trying to connect as quoted by previous user me
He was talking about me.
Again, good luck mr. Expert! ;)
Ah my bad. But what you said is correct. We’re here on the forum to help each other if people want private support they should submit ticket then instead of getting offended with the answers from valuable users. Debug logs are intended for the webmasters only to find issues then disabled. it's not for public to see. So if you leave debug enabled you aren't a very good freelancer. Debugs may contain issues for attackers to find vulnerabilities or break throughs so not sure you're even worried the database data is showing as long as the debug log is disabled which should be.
-
@Digitalcay Limited
Actually, the guy is acting idiotic, as I'm getting these type of errors all the time on my test environment (512 ram, 1 slooow core, slow connection).
When I do crazy stuff, my DB crashes, PHP runs out of memory etc.
But yeah, the guy is an expert and all of us are stupid.
-
@Digitalcay Limited
Actually, the guy is acting idiotic, as I'm getting these type of errors all the time on my test environment (512 ram, 1 slooow core, slow connection).
When I do crazy stuff, my DB crashes, PHP runs out of memory etc.
But yeah, the guy is an expert and all of us are stupid.
Yep I agree.
OP says he is using an older version of osclasspoint. He should either keep osclasspoint up to date, use another server provider or disable debug logs after each maintenance. No point in reporting PHP issue for a task done months ago, leaving logs enabled and then claiming now that you see errors in your debug logs from way back. Nobody knows what updates/maintenance you've done on your environment for that to show up. If it's a security loop hole, which I doubt or from either while doing work on osclass or the mysql connection drops. This needs to be reported privately to the developer to check your activities done for that to show up. You don't go post on support forums seeking help for an issue that provides personal data like this then get offended by each answer when you haven't included any detailed steps for that to show up. Like we both said, debug logs are just for developers only and your responsible for disabling it. All kinds of errors will show there which should only be visible to developers only. Sometimes, you may be logging sensitive data like signatures, keys, passwords, emails, usernames etc. Disabling the logging can prevent from accidentally leaking such information. Having that public you may as well put user demo password demo in your hosting control panel.
Anyway no more here, best of luck!
-
@Digitalcay Limited
Actually, the guy is acting idiotic, as I'm getting these type of errors all the time on my test environment (512 ram, 1 slooow core, slow connection).
When I do crazy stuff, my DB crashes, PHP runs out of memory etc.
But yeah, the guy is an expert and all of us are stupid.
Let the developer of the script reply and please refrain from personal attacks, like idiotic etc etc. Calling names is easy, give some good advice is not.
-
ok, then logging passwords and db names out in public TEXT files is ok.
Full of experts here, i guess. A lot of talk, with no help. Just blaiming the server etc etc.
Please, if the developer of the script can (even silently) fix this in the future. Do not log errors in the log with passwords.
Thanks.
-
Mate, I run 8 servers and 2 businesses with one of them gaining 16k daily visitors according to analytics and earning me 6k gbp per month and you’re telling me I have no clue😂. How come this issue isn’t showing on one of my classified ads sites in debug logs it’s only showing for you. Sloppy webmaster or very bad hosting provider you have so you pick. Yes it’s from osclasspoint trying to connect to the MySQL extension when it goes down and nothing else and the script is failed to connect as quoted by previous user.
ok, i don't doubt that. It is ok with you to have plain passwords in ANY ANY log (txt file)?
The passwords are only in config.php and php files can't (normally) be viewed.
I don't care what you run and you do not run. I only comment what i see in the sites i maintain. I don't care about anything else.
-
ok, then logging passwords and db names out in public TEXT files is ok.
Full of experts here, i guess. A lot of talk, with no help. Just blaiming the server etc etc.
Please, if the developer of the script can (even silently) fix this in the future. Do not log errors in the log with passwords.
Thanks.
You're not that smart. We've explained to you what debug.logs do.
Even for apps I create on environments (non-related to osclass) for other things will sometimes be logging sensitive data like signatures, keys, passwords, emails, usernames etc. It's not just for OsClass. You don't need to doubt anything for what I do. I'm just stating facts. It's your responsibility to not show debug logs to public (same way config.php permissions). You can do that but I'm sure you're very smart to fix that yourself.
-
You're not that smart. We've explained to you what debug.logs do.
Even for apps I create on environments (non-related to osclass) for other things will sometimes be logging sensitive data like signatures, keys, passwords, emails, usernames etc. It's not just for OsClass.
Again you are calling me names. No other script that i know logs passwords in plain text file. Even Osclass 3.9, Osclass 5.x, doesn't do that.
I don't need any explaination from you. Just let the developer (that i respect) to solve this. No such detailed information (unneeded) should be recorded EVER.
-
You're not that smart. We've explained to you what debug.logs do.
Even for apps I create on environments (non-related to osclass) for other things will sometimes be logging sensitive data like signatures, keys, passwords, emails, usernames etc. It's not just for OsClass.
Again you are calling me names. No other script that i know logs passwords in plain text file. Even Osclass 3.9, Osclass 5.x, doesn't do that.
I don't need any explaination from you. Just let the developer (that i respect) to solve this. No such detailed information (unneeded) should be recorded EVER.
I am not calling you names but whatever. I repeat if you need explanations do not post on support forums. It's a public forum that anybody can try help but if you can't take help from other members then it shouldnt be posted here. You don't seam to know the difference between a support forum and private ticketing system.
Let me explain easily.
Developer only support --> Submit a ticket
Community help (anybody) --> Support forums
dsf = don't like support from anybody but developer
Solution = submit private ticket
Understand?
Best of luck!
-
It's a public forum that anybody can try help but if you can't take help from other members then it shouldnt be posted here. You don't seam to know the difference between a support forum and private ticketing system.
This is a security issue, it should be posted so people know and fix it. And webmasters protect themselves. Because disabling debug is not enough, you must also delete the debug.log (nobody does that).
I have nothing else to say or reply, i'm dissapointed from all that.
I just hope the developer is a reasonable guy that loves his business, and will handle that better in future releases.
-
It's a public forum that anybody can try help but if you can't take help from other members then it shouldnt be posted here. You don't seam to know the difference between a support forum and private ticketing system.
This is a security issue, it should be posted so people know and fix it. And webmasters protect themselves. Because disabling debug is not enough, you must also delete the debug.log (nobody does that).
I have nothing else to say or reply, i'm dissapointed from all that.
I just hope the developer is a reasonable guy that loves his business, and will handle that better in future releases.
Alright, best of luck with the fix.
-
@dsf The name-calling was a result of your arrogant attitude towards everyone that tried to help you.
Your initial issue was related to the PHP Fatal error, then you escalated it to something else that frankly needs a separate topic.
You keep asking for answers from the developer (arrogantly dissing everyone else), yet he gave you an answer:
@dsf
For me it works, generated if you set osclass to save logs into file.
Like it?!
And yet, we are the bad guys...
Good luck!
-
:P :P tested it on subdomain to crash db with debug.log on but it only returns error db username and user is using password (yes)... No password shown in my log file..
In apache error maybe but that is not visible to users....
-
If it would return password, it would by mysqli vulnerability. I am not sure why osclass should filter logs from PHP libraries...