Skip to content

Show full error message and hide backtrace#19934

Open
kamil-tekiela wants to merge 3 commits intophpmyadmin:masterfrom
kamil-tekiela:Fix-error-handling
Open

Show full error message and hide backtrace#19934
kamil-tekiela wants to merge 3 commits intophpmyadmin:masterfrom
kamil-tekiela:Fix-error-handling

Conversation

@kamil-tekiela
Copy link
Contributor

There are two problems with how phpMyAdmin reports errors at the moment in production:

  • it shows backtrace which isn't that useful to a developer, and especially not useful to the user, but it could expose some sensitive information to a potential attacker
  • it doesn't show where the error/exception happened.

This PR should help avoid situations like this: #19904

When a warning happens it will show it like this:
image

and when an error happens, it will show an alternative error page:
image

@williamdes
Copy link
Member

I am not sure to understand the after, can you share a screenshot?

@kamil-tekiela
Copy link
Contributor Author

This is the before:

Warning:
image

Error:
image

Signed-off-by: Kamil Tekiela <tekiela246@gmail.com>
Signed-off-by: Kamil Tekiela <tekiela246@gmail.com>
if (! ($exception instanceof \Error) || ! $this->hideLocation) {
$message .= ': ' . $exception->getMessage();
}
$message = $exception::class . ': ' . $exception->getMessage();
Copy link
Member

@MauricioFauth MauricioFauth Nov 15, 2025

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

There are some error messages that shows a full path. That's why the message is not included. If there's a way to sanitize the message to remove full paths, that'll be great.

Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I can sanitize the path, e.g. with basename() but I would need to know when that happens. I can't think of a situation when that would happen now.

Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

A TypeError is an example.

Example from #19537:

TypeError: PhpMyAdmin\Util::formatNumber(): Argument #1 ($value) must be of type string|int|float, null given, called in /home/demo/.pma-demo-web/master-config/src/Controllers/Database/Structure/RealRowCountController.php on line 76

Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I never noticed until now. You are right that these two messages contain the full path. https://github.com/php/php-src/blob/master/Zend/zend_exceptions.c#L740

Signed-off-by: Kamil Tekiela <tekiela246@gmail.com>
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

4 participants

Comments