MODx shows MySQL-Errors to the public

- 8 Posts
SiSt Reply #1, 19 years, 2 months ago
Hi all,

I like that modx shows php errors only to the logged in manager. But MySQL errors are shown to the public on the frontpage. For me this is a huge security issue. Shouldn’t the document.parser.class.inc.php contain something like that?

Change starting from line 2619 (MODx 0.9.6)
```
// Display error
echo $parsedMessageString;
ob_end_flush();
```
into
```
// Display error
if(isset($_SESSION['mgrValidated']) AND $_SESSION['mgrValidated']) {
    echo $parsedMessageString;
    ob_end_flush();
}
```