UBB.Developers Forums Community Development Programming PHP and Server-side Scripting Differences in database security from 6.0.3 to 6.1

I'm getting an error of:

SQL ERROR: Database error only visible to forum administrators

after the upgrade from 6.0.3 to 6.1br1. This is when I am using the ubbt cookie and groups to allow a user to modify information in a new table in the ubbt database. This is a table I made, not part of ubbt. This used to work great, but after the upgrade, it seems the security has changed, or the cookie is different. So I am basically needing to know what changed with ubbt that would give this error, so I can make adjustments to my site for it. I have looked over much of the new code, but have yet to see anything that would cause a conflict.

Sounds like it might be the cookie changes, log out, clear your cookie, then log back in and see if it's cleared up.

There is a table prefix and a cookie prefix being used in 6.1 so you should make sure that the prefixes match your old table prefix and cookie prefix which were hard coded in before. (w3t_)

HMM, upon further investigation and testing, it seems that the data IS updated in the database, but that error is given. I can still verify they are a member of a group ok, but this error is very annoying and causing major confusion with users.

I have the table name hardcoded into the page that UPDATES or INSERTS into the table. I have cookies set sitewide, with no special prefix set since I only have one public board. (The other is a test site) I deleted all cookies and started over and it still happens.

I use this code at start of page to grab the cookie.

code:

  $PathToThreads = "c:/inetpub/wwwroot/www.newoutriders.org/ubbthreads/";

   require ("{$PathToThreads}main.inc.php");
   $userob = new user;
   $user = $userob -> authenticate(U_Groups,U_Username);
   $html = new html;

---

Any more thoughts?

In your mysql.inc.php file change this:

code:
 
      $What = find_environmental ("SCRIPT_NAME"); 
      if ( ($user['U_Status'] != "Administrator") 
         && ( (!stristr($What,"createtable")) && (!stristr($What,"altertable")) 
         && (!stristr($What,"ubbimport.php")) ) ) { 
            $error = "Database error only visible to forum administrators"; 
      } 
      else { 
         $this->errordesc = mysql_error(); 
      } 
 

---

to this:

code:
 
      $What = find_environmental ("PHP_SELF"); 
      if ( ($user['U_Status'] != "Administrator") 
         && ( (!stristr($What,"createtable")) && (!stristr($What,"altertable")) 
         && (!stristr($What,"ubbimport.php")) ) ) { 
            $error = "Database error only visible to forum administrators"; 
      } 
      else { 
         $this->errordesc = mysql_error(); 
      } 
 

---

And see if that will give you a more descriptive error message. Then post the error message here.

I think I'll mention this change to Scream and see if this needs to be added to 6.1 as I have never been able to get a descriptive error message either. This could be do to how php is set and what environmentals are avialable to the users too.

If you mention that, also mention that if the SQL error is suppressed, it should be appended to a log file, with a timestamp, IP and username.

The same timestamp should also be included in the displayed " ... only visible ..." message, to facilitate matching it up with the full message in the log file.

That would be helpful for user-reported MySQL errors, as well as ones that you get yourself.

Well perhaps that's not the problem then. Are you logged in as an Admin and can the script that is generating the errors read the cookie to verify your status?


The sql error is more descriptive than the one displayed to non admins...

I do not get this error when loged in as an admin, only on a non-admin login.

Ok then let's just show everyone the actual error then so we can get an idea of what it is.

change this:

code:
 
      $What = find_environmental ("SCRIPT_NAME"); 
      if ( ($user['U_Status'] != "Administrator") 
         && ( (!stristr($What,"createtable")) && (!stristr($What,"altertable")) 
         && (!stristr($What,"ubbimport.php")) ) ) { 
            $error = "Database error only visible to forum administrators"; 
      } 
      else { 
         $this->errordesc = mysql_error(); 
      } 
 

---

to this:

code:
 
      $What = find_environmental ("SCRIPT_NAME"); 
      if ( ($user['U_Status'] != "Administrator") 
         && ( (!stristr($What,"createtable")) && (!stristr($What,"altertable")) 
         && (!stristr($What,"ubbimport.php")) ) ) { 
            $error = "Database error only visible to forum administrators"; 
            $this->errordesc = mysql_error(); 
      } 
      else { 
         $this->errordesc = mysql_error(); 
      } 

---

in your mysql.inc.php file and then login as a non admin user and see what the error could be.

Still the same error, no additional error message given to non-admin. Still works fine with no error for admin.

That's odd. I thought there would be a description with any sql error.

It's hard to say what the problem is untill we can see what is causing the error with mysql.

This is too weird, a reboot did no good. Maybe I'll check for a MySQL upgrade, I know I'm one version of PHP behind too. The same code works fine on a different section of the website with a different table of it's own. Maybe I'll check to see if this table got corrupted. If that fails, then I'll kick the server!