The default installation of Opencart 3.x is sending to the output your private Database informations if you are not hiding the errors. I published a Workaround.
Some of the open issues regarding the problem:
https://github.com/opencart/opencart/issues/6647
https://github.com/opencart/opencart/issues/7650
https://www.opencart.com/index.php?rout ... n_id=41233
The real issue is your insecure server configuration. You need to switch off displaying of errors in 3 places.
To stop all errors being displayed you need to do all of the following.
1. Set the PHP display_errors setting to Off (or 0 or false). This may need to be done in you main php.in, local php.ini, user.ini, .htaccess or hosting control panel, depending on you hosting setup.
2. Set $_['error_display'] to false in you system/config/default.php file.
3. Set Display Errors to No in the OpenCart settings.
What you have done is just suppressed the database start up error. What about the other PHP exceptions and errors that could output sensitive data? You are not suppressing these. There are SQL injection techniques that output data in a query exception. By not configuring your server securely and just applying your fix, you would be still vulnerable to these.
To stop all errors being displayed you need to do all of the following.
1. Set the PHP display_errors setting to Off (or 0 or false). This may need to be done in you main php.in, local php.ini, user.ini, .htaccess or hosting control panel, depending on you hosting setup.
2. Set $_['error_display'] to false in you system/config/default.php file.
3. Set Display Errors to No in the OpenCart settings.
What you have done is just suppressed the database start up error. What about the other PHP exceptions and errors that could output sensitive data? You are not suppressing these. There are SQL injection techniques that output data in a query exception. By not configuring your server securely and just applying your fix, you would be still vulnerable to these.
Who is online
Users browsing this forum: No registered users and 71 guests
