Undefined variable results in connectstring being logged including password

Created on 20 September 2023, over 1 year ago

Problem/Motivation

When php specifies a log file, opening the adminer page and select some databases will result in logging of an undefined variable and a call stack that includes the full conect string including PLAIN TEXT credentials (scripts are compressed, so linenumbers are not that reliable).

Steps to reproduce

Opening the adminer page and select some databases to flush the error_logging. (using php 8)

Proposed resolution

Because of the compression a code fix is hard locate (in the followng line $ag triggers the notice into the logging).

$z=="Rows"&&$X&&$R["Engine"]==($ag=="pgsql"?"table":"InnoDB")?"~ $X":$X))

A fix is to use a hex editor to patch line 10 of the compiled adminer script (a text editor fails as there are images & icons serialized).

At line 10, 'error_reporting(6135)' should be patched to either 'error_reporting(6129)' which removes parse & notices or 'error_reporting(0000)' to completely disable logging.

Remaining tasks

User interface changes

API changes

Data model changes

πŸ› Bug report
Status

Active

Component

Code

Created by

πŸ‡³πŸ‡±Netherlands wvd_vegt

Live updates comments and jobs are added and updated live.
Sign in to follow issues

Comments & Activities

Production build 0.71.5 2024