How to prevent Joomla from reporting database error information

Question

I'm currently investigating SQL injection attack vectors in my application. Currently, Joomla is reporting database error output when returning a HTTP 500 error page. How do I prevent this?

The display_errors setting is disabled in php.ini (though I am generally assuming this is not so relevant for error pages resulting from MySQL errors anyway?), and I have set 'Error Reporting' to 'None' in the Joomla Server Settings page, yet I still get the error being reported. Example error output is below.

1062 - Duplicate entry '!~!my_db!~!1' for key 'group_key' SQL=SELECT id, component, view, layout, task, field, link, content FROM
#__hint_text WHERE (component = 'com_mycomponent' OR component = '*') AND (view = 'someview' and(/**/sElEcT 1 /**/fRoM(/**/sElEcT count(*),/**/cOnCaT((/**/sElEcT(/**/sElEcT /**/cOnCaT(0x217e21,/**/dAtAbAsE(),0x217e21)) /**/fRoM information_schema./**/tAbLeS /**/lImIt 0,1),floor(rand(0)*2))x /**/fRoM information_schema./**/tAbLeS /**/gRoUp/**/bY x)a) and '1'='1' OR view = '*') AND (layout = '' OR layout = '*' OR layout IS NULL)

To be clear, I don't need advice on how to fix SQL injection attack vectors in my code - I just want to know how to prevent Joomla from revealing information where I may have a yet undetected coding error.

Answer 1

The laziest way to address this - is to create an empty error.php file (with no content whatsoever) and place it in your templates/yourtemplate folder (if you have an error.php file, just replace it with that empty file.

I personally think that the error.php file should provide the least amount of information possible - and there is nothing less than an empty file.

On the flip side, it is a good idea to return a 404 header in your error.php file (just the 404 header), as a 500 error is typically an invitation for hackers. See this post on how to return 404 headers on your Joomla website.

Designers tend to worry about error pages and how to make them even "fancier" - thinking that most of the visitors to these pages are real people who lost their way. In the real world, however, the absolute majority of traffic on error pages is malicious traffic (you can verify this by checking your server logs).

Answer 2

I would start by checking your template error page. You may want to edit the page located in /templates/YOUR_TEMPLATE/error.php This file will report all the errors and backtrace to the front end. Try commenting out this part:

echo htmlspecialchars($this->error->getMessage(), ENT_QUOTES, 'UTF-8');

If you don't have such a file in your template, Joomla framework will take the one located in /templates/system/error.php so make sure you have a template override and don't modify this last version as it might me overwritten if you update Joomla to a newer version