3 ms·
Warning: User 'newgeog_todbot' has exceeded the 'max_questions' resource (current value: 720000) query: SELECT CASE WHEN status=1 THEN 0 ELSE 1 END FROM access
by Yhippa 11y ago
Warning: User 'newgeog_todbot' has exceeded the 'max_questions' resource (current value: 720000) query: SELECT CASE WHEN status=1 THEN 0 ELSE 1 END FROM access WHERE type = 'host' AND LOWER('96.89.0.129') LIKE LOWER(mask) ORDER BY status DESC LIMIT 0, 1 in /home/newgeog/public_html/includes/database.mysql.inc on line 172
Exposing your SQL queries in an exception on a public-facing website does not seem like a best practice.
- mcantelon 11y agoTheir file paths too. Looks like they're running Drupal by the tables. EDIT: Yup, Drupal 5.7 seemingly (old, likely security issues). http://www.newgeography.com/CHANGELOG.txt http://www.newgeography.com/CHANGELOG.txt
- dragonwriter 11y agoFrom a UX POV, probably not. If this is a security complaint, well, its less exposed information (a strict subset) than if your app was open source, so I don't see it as particularly a problem.
- viraptor 11y agoActually it's not a subset. Even if the app is open source, what you gain from this error is: username, installation path, resource limits. All of those add something you don't know from the code itself. All can be useful when trying (respectively) injections / bruteforce auth, path traversal / secrets access, denial of service. Also line numbers can help you identify the deployed version. Also optional table prefixes which are deployment-specific.
- dragonwriter 11y agoYou're right, I was wrong; leaving the grandparent post just for context for your response, otherwise I'd delete it.
- __z 11y agoInformation leakage is considered a security vulnerability. https://www.owasp.org/index.php/Information_Leakage https://www.owasp.org/index.php/Information_Leakage