10

In my table I have created an index on 'col1' to prevent duplicate entries which works well but the resulting error message displayed to a user when they attempt to add a duplicate entry seems to to me be a security concern as it displays the SQL including the table prefix.

Is there any way to stop Joomla from displaying the SQL in the error message?

I've tried changing the error reporting settings in the global config but it has no effect as far as I can tell...

Example message:

Error

Save failed with the following error: Duplicate entry 'Test' for key 'TestKey' SQL=INSERT INTO `jml_mycomp_tbl1` (`id`,`col1`,`ordering`,`state`,`created_by`) VALUES ('0','Test','2','1','730')

  • 1
    I'm new to Joomla, but you are absolutely right, any userland errors in a production environment should not contain any SQL. Not just for security, but because it is meaningless to users and gives a bad user experience. In a production environment, display_errors (PHP setting) should be off and such errors should only be logged to your server-side error log. – MrWhite May 13 '14 at 23:22
  • Just curious, you've probably already checked this but you dont happen to have any debug settings enabled do you? Check: Global Config > debug system setting. Check: Global Config > Error reporting level. Check: Plugins > Debug plugin Just curious if you have anything strange going on. I ask because I was reading this learn.theartofjoomla.com/developing-extensions/… – Chad Windnagle May 14 '14 at 2:18
  • @ChadWindnagle Hi Chad, yes I tried turning that on off but no effect... – doovers May 14 '14 at 2:19
  • sorry just edited, can you just let me know you saw the updated contents? thnx! – Chad Windnagle May 14 '14 at 2:20
  • @ChadWindnagle No I hadn't seen your edit! I did try error reporting but I forgot about disabling plugin (thanks for the tip) which I just tried now but still no effect! – doovers May 14 '14 at 2:27
6

Maybe you can use a try catch command:

try
{
//Your code to run the SQL here 
}
catch (Exception $e)
{
$this->setError('The error message you want');
return false;
}
  • Thanks for the suggestion but since I was using JTable the best solution was to override the check method as in my answer. – doovers May 14 '14 at 8:39
  • This is good answer – David Addoteye Nov 5 '15 at 3:29
3

Since it doesn't appear to be possible to prevent this behaviour, I implemented the following solution. Add a duplicate check to a JTable check method override:

// Check for duplicate entry
$db = JFactory::getDbo();
$query = $db->getQuery(true);

$query->select('COUNT(*)');
$query->from($this->get('_tbl'));
$query->where($db->quoteName('col1') . ' = ' . $db->quote($this->col1));

$db->setQuery($query);
$result = $db->loadResult();

if ($result) 
{
    $this->setError(" Duplicate entry for col1 = '" . $this->col1 . "'");
    return false;            
}
1

You should change your code that makes the insert to firstly check for duplicate and return a proper error (one that you write) to the user and not rely on showing the actual error returned by MySQL.

  • Yeah I thought I might have to do that but I'm still concerned that Joomla is happy to show the SQL in an error message displayed to the user. Surely this is a security concern?? I thought the whole point of the random table prefix is as a security measure no? Maybe best practice is to do your own error handling but there may be situation that you cannot foresee... Just seems a bit strange to me! – doovers May 13 '14 at 23:08
  • Well, Joomla! doesn't show the SQL error message to the user, your code does. – Ivo May 13 '14 at 23:20
  • I disagree, my code does not show the error message but allows the Joomla core code to show it. In my opinion, the core code should not display the table prefix in any circumstance as it is a security concern... – doovers May 13 '14 at 23:29
  • Why don't you use INSERT IGNORE instead of INSERT? – Ivo May 14 '14 at 0:10
  • Good suggestion and I could do that but since I am using JTable I would be more inclined to override the check method and test for a duplicate there. I want to display an error message to the user, just not with the SQL in it! – doovers May 14 '14 at 0:49

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.