I have an Ubuntu server with some custom php application based on doctrine. The server runs apache-2.4, mysql and php7.2-fpm. After testing a misconfiguration for the database connection in my application, the webserver logs the error with the pdo connection, username AND password.

I found this question on stackoverflow: https://stackoverflow.com/questions/6455018/why-does-pdo-print-my-password-when-the-connection-fails

But turning display_errors off doesn't seem to help not logging passwords into the apache error log.

So my question is: How / where / what do I have to configure to turn password logging off?

Here is the part of the apache error log:

AH01071: Got error 'PHP message: PHP Fatal error: Uncaught PDOException: PDO::__construct(): php_network_getaddresses: getaddrinfo failed: Temporary failure in name resolution in /.../PDOConnection.php:27\nStack trace:\n#0 /.../PDOConnection.php(27): PDO->__construct('mysql:host=loca...', 'username', 'password', Array)

  • 1
    Regardless of how you eventually prevent this from being logged, this also needs to be reported to the developer as a bug, as they should have caught this exception and acted on it. Which, coincidentally, would have prevented the log message. – Michael Hampton Jun 19 at 16:17
  • Thanks for your comment. First I thought, doctrine would handle this kind of error. I am not deep into doctrine so maybe it's a misconfiguration by myself. On the other hand: You are right, I should even catch this by myself. Nevertheless there should be (I hope there is) some configuration to not log user credentials. – Der Alex Jun 24 at 4:28

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.