how to stop full DB errors showing to members ?!

can anyone please tell me how I can stop DB errors showing in full to viewers ?

anyone able to help with this ?

I need to stop visitors / members seeing Database query errors etc

A quick search didn't show anything.  Of course you still want a way to know when an error occurs beside just checking logs.  If there is a switch to turn off the error reporting, it will be a part of my.conf.  Check Oracle's website.

 It has been pointed out to me and I realize the person is correct that when these errors are displayed on screen it shows sensitive information's that hackers can learn from and exploit ...

I thought changing 'error_display' and similar settings would prevent them showing but it's not ...

edit: display_errors'

You see errors? How? I thought dolphin handles them. If i have a db error (connection, query etc) dolphin outputs just a box with "Database Error" or something similiar. The real error and stack strace is being send by email to the site admin.

Anyway my php.ini has "display_errors = Off" maybe you have a typo? You wrote "error_display"......

I also use

display_startup_errors = Off
log_errors = On
track_errors = Off
html_errors = Off

you are correct .... I mean 'display_errors'  .... mine is also OFF yet, when there are DB query errors the entire error is displayed ?!

This can be exploited ...

For such changes to take effect you must restart apache. did you?

ahh ...  I was restarting mysql server ...

Reporting php errors are not the same as reporting errors from the mySQL server; therefore, your error settings in php.ini don't have any effect on mySQL.  I don't have time to search for this now but I would go to Oracle and look through the documentation for mySQL.  You can temporary set configurations but to permanently set the config for mySQL server, you will need access to the my.conf file.

Since when MySQL can throw errors directly to a webpage? MySQL errors are going to log files. If you use php to connect to MySQL then php is throwing them.

even with display_errors' OFF and restarting server errors are still visible in full ...

Can you check what phpinfo() is reporting on the variables set?

Did you get an email with the same error log?

This is what members /visitors see >>> entire report !

You not answered my questions before. Can you also post res() {} function of BxDolDb.php?

Also in /inc/classes/BxDolDb.php what is set for

define( 'DB_FULL_VISUAL_PROCESSING', true );
define( 'DB_FULL_DEBUG_MODE', false );
define( 'DB_DO_EMAIL_ERROR_REPORT', true );

 function res($query, $error_checking = true)
    {
        if(!$query)
            return false;

        if (isset($GLOBALS['bx_profiler'])) $GLOBALS['bx_profiler']->beginQuery($query);

        $res = @mysql_query($query, $this->link);

        if (false === $res)
            $this->error_message = @mysql_error($this->link); // we need to remeber last error message since mysql_ping will reset it on the next line !
        else
            $this->error_message = '';

        if (false === $res && !@mysql_ping($this->link)) { // if mysql connection is lost - reconnect and try again
            @mysql_close($this->link);
            $this->connect();
            $res = mysql_query($query, $this->link);
        }

        if (isset($GLOBALS['bx_profiler'])) $GLOBALS['bx_profiler']->endQuery($res);

        if (!$res)
            $this->error('Database query error', false, $query);
        return $res;
    }

define( 'DB_FULL_VISUAL_PROCESSING', true );
define( 'DB_FULL_DEBUG_MODE', true );
define( 'DB_DO_EMAIL_ERROR_REPORT', true );

Should I set define( 'DB_FULL_DEBUG_MODE', true );  to false ?

Yes, i really dont know why it is on. Then clear cache

If it is not helping check phpinfo() too if the php variables are set.

^^^^

setting that to false did not work ....

I don't see 'display_errors' in variables ?!

I set it to OFF via plesk panel

I feel strange, DB_FULL_DEBUG_MODE set to FALSE should not output any extra lines anymore. There should really only be "Database query error".

Maybe some cache problem? Just clean the cache again and restart the server to be sure.
Why phpinfo() is not showing you any of the variables is strange. I dont use any software like Plesk etc.
Are you on a shared server?

nope I have dedicated ...

I will try that again a bit later and update thread ...

its 13:43 in the afternoon and I have been up for over almost 31 hours researching and sorting out security issues as you may have read in forum threads ...  Need to grab a few hours sleep before my head crashes through my screen :)

thank you for time and help so far ...

You need to set DB_FULL_VISUAL_PROCESSING to false.

OK, that's better thank you ... is there away I can get custom page to show OR auto redirect users to previous page when the errors happen please ?

Currently I see plain white page with small 'database error' message and it does not redirect or anything ...

OK forget this now ... I worked it out >>

Here's what my members see when there is a DB error now : http://www.socialmunch.com/videozone/playvideo/1323

Alex, correct me if i am wrong, but this only removes the style around the "error" string. Most important is DB_FULL_DEBUG_MODE set to false.

I just checked my 7.1.0 and it was set to true. Looks like 2 month ago you changed this back like it was before. http://www.boonex.com/trac/dolphin/changeset/17485/

This is what all DB errors now look like to my members / visitors when they occur (example link: http://www.socialmunch.com/videozone/playvideo/1323):-

how did you make this happen?? ;)

I coded it to work like this in BxDolDb.php

if you click the example link you can see it's a far better way of showing users there is a error without it seeming to much of a issue ... I personally think 'Database error' or 'Database query error' sounds bad to viewers and this if far more friendly :)

INSTRUCTIONS HOW TO DO WHAT I DID ....

open: inc/classes/BxDolDb.php  and go to line 236

find:-

if (!$res)
            $this->error('Database query error', false, $query);
        return $res;

change to this below and edit red areas with your own details / information:-

if (!$res)
            $this->error('<p style="text-align: center; padding-top: 200px;"><a href="http://www.mysite.com"><img src="http://www.mysite.com/image/location.png" alt="Error"></a><br><br><font size="5" color="red">OHH SNAP! We have encountered an error -- Please click back in your browser and return to the previous page<br>OR <br>click logo to visit <font color="#6666cc">SITE<font color="#ff6600">NAME<font color="red"> home page ...', false, $query);
        return $res;

Thanks, can we place this on our Dolphin mod site, http://modmycms.com?  Or if you wish, create an account and create a post for it.

 YVW ... feel free to add it :)

Not only do I think it looks better and not so serious looking to audience (like normal DB errors can look) BUT it also instructs the viewer to click back OR click away to site page unlike how normal DB errors work ...

 Just to add >> this can also be adjusted to 'auto redirect' to another page when DB errors occur

DB_FULL_DEBUG_MODE - turn on to dump full error log

DB_FULL_VISUAL_PROCESSING - turn on to output full dump to the browser, DB_FULL_DEBUG_MODE should be ON as well

DB_DO_EMAIL_ERROR_REPORT - turn on to send full dump by email, DB_FULL_DEBUG_MODE should be ON as well

Both DB_FULL_DEBUG_MODE and DB_FULL_VISUAL_PROCESSING should be ON for development or temporary debugging purposes only, we leave DB_FULL_DEBUG_MODE ON by mistake, it should be off. 

Now by default full error message is sent by email, and for user short error message is displayed without any sensitive info.

I know this is old, but I just installed 7.4.1, and this is not available. I want to be able to show database errors on screen - how to do this?

Thanks in advance

Dolphin 7.4 has new error handling.

Look in inc/header.inc.php.

Change this.

$site['fullError']         = false;

To This

$site['fullError']         = true;

That should do it.

 thanks so much. I am working on something and need to see all errors on screen rather than trying to go through the logs.