Can't stop SwiftMailer Exceptions Being Displayed to Browser in Laravel - php

I am using Laravel for a site. I have a page where users can contact me. This sends me an email using the SwiftMailer bundle. It has just been brought to my attention that the following error is seen when trying to send a message
Fatal error: Uncaught exception 'Swift_TransportException'
Exception thrown from here /Applications/MAMP/htdocs/yooies_site/bundles/swiftmailer/library/classes/Swift/Transport/Esmtp/AuthHandler.php on line 176
Code at this location is:
throw new Swift_TransportException(
'Failed to authenticate on SMTP server with username "' .
$this->_username . '" using ' . $count . ' possible authenticators'
);
The cause of the error is not a worry (I found out that I had change my mail password and forgot to change in my sites email config)
The issue I have is that I have Laravel setup to log any exceptions and NOT display them on the main page. I have the following setup in my error.php config file
'detail' => false,
'log' => true,
Why then is my site showing the exception on the page instead of a 500 error?
Full stack trace here (Note I have removed my sites real name and replaced with 'site'
Fatal error: Uncaught exception 'Swift_TransportException'
with message 'Failed to authenticate on SMTP server with username "info+site.com" using 2 possible authenticators'
in /Applications/MAMP/htdocs/site/bundles/swiftmailer/library/classes/Swift/Transport/Esmtp/AuthHandler.php:176
Stack trace:
#0 /Applications/MAMP/htdocs/site/bundles/swiftmailer/library/classes/Swift/Transport/EsmtpTransport.php(307): Swift_Transport_Esmtp_AuthHandler->afterEhlo(Object(Swift_SmtpTransport))
#1 /Applications/MAMP/htdocs/site/bundles/swiftmailer/library/classes/Swift/Transport/AbstractSmtpTransport.php(124): Swift_Transport_EsmtpTransport->_doHeloCommand()
#2 /Applications/MAMP/htdocs/site/bundles/swiftmailer/library/classes/Swift/Mailer.php(79): Swift_Transport_AbstractSmtpTransport->start()
#3 /Applications/MAMP/htdocs/site/application/libraries/personal/mailer.php(55): Swift_Mailer->send(Object(Swift_Message))
#4 /Applications/MAMP/htdocs/site/application/config/error.php(91): Personal\Mai in /Applications/MAMP/htdocs/site/bundles/swiftmailer/library/classes/Swift/Transport/Esmtp/AuthHandler.php on line 176
Laravel version is L3.
Bundle URL here http://bundles.laravel.com/bundle/swiftmailer

Swiftmailer doesn't touch any configuration that's responsible for showing errors. Among the recommendations for production servers is to have display_errors = Off and display_startup_errors = Off, which can be set in php.ini, httpd.conf, .htaccess, .user.ini, etc, or even using ini_set(). You should make sure these directives are correctly set.
I'm not familiar with how Laravel handles exceptions and errors, but it looks like the Swift_TransportException is thrown outside of Laravel's error-handling process. Can you point out where in the flow of the application the exception is thrown? Maybe a stack-trace?
PS: Just a tip: Things like sending emails are better not done during a request at all. You could offload it to some sort of queue, and have another process on the server handle it. You could take a look at Gearman for this.
update
Looking at the stack-trace, it seems Laravel does catch the exception because Log::exception(); is invoked (in application/config/error.php line 91). But the trace doesn't reveal how it got there. Maybe you can run it on a development machine where you have Xdebug installed. Xdebug will give you a more precise stack-trace when the exception is throws, ending with public/index.php (where the request started).

Related

Uncaught exception 'Google_ServiceException' with message 'Error calling GET https://www.googleapis.com/oauth2/v2/userinfo: (500) Backend Error'

I have setup Google Login for one of my sites (vps hosting - apache). Not a problem at all, pretty much exactly the same as facebook login... easy!
I have another site (shared hosting - apache - addon domain), it doesn't have SSL yet, so i cant implement facebook login. From what i have seen, google is not as fussy about ssl yet. So i planned to do twitter and google+ login for this non ssl site. Atleast until i actually feel its worth moving to the next phase and setting ssl up.
So i literally did exactly the same as before, i have obviously cchanged the relevant parts like the insert sql and the redirects and google dev console. Yet im getting this annoying problem;
The page just continuosely redirects from my site back to google and so on until the browser decided there is a redirect loop. In my server error logs i have this;
[16-Sep-2016 11:40:26 America/Chicago] PHP Fatal error: Uncaught exception 'Google_ServiceException' with message 'Error calling GET https://www.googleapis.com/oauth2/v2/userinfo: (500) Backend Error' in [sensoredforSO]/GplusLogin/src/io/Google_REST.php:66
Stack trace:
#0 [sensoredforSO]/GplusLogin/src/io/Google_REST.php(36): Google_REST::decodeHttpResponse(Object(Google_HttpRequest))
#1 [sensoredforSO]/GplusLogin/src/service/Google_ServiceResource.php(177): Google_REST::execute(Object(Google_HttpRequest))
#2 [sensoredforSO]/GplusLogin/src/contrib/Google_Oauth2Service.php(37): Google_ServiceResource->__call('get', Array)
#3 [sensoredforSO]/GplusLogin/index.php(30): Google_UserinfoServiceResource->get()
#4 {main}
thrown in [sensoredforSO]GplusLogin/src/io/Google_REST.php on line 66
Google doesnt seem to have any content on this so i thought id throw it out to you boffins.
Thanks in advance.
Really simple. Upgrade to the latest version of the google api SDK from Github, Make sure the server is running php 4 or above. Hey presto! it works. So much for this place having boffins!

Getting 500 Internal Server Error with Stripe

I am trying to implement basic functionality of the Stripe API, I get 500 Internal Server Error for some reason when I require the Stripe.php file that you have to require...When I comment the require out the error goes away but obviously I can not use the API then..
Basic require...shows error in the Modal Log
require_once('/php/Stripe.php');
I checked the server error and it gave me this back
Fatal error: Uncaught exception 'Exception' with message 'Stripe needs the Multibyte String PHP extension.' in /php/Stripe.php:13 Stack trace: #0 /home/stripepost.php(4): require_once() #1 {main} thrown in /php/Stripe.php on line 13
This all comes from just requiring the file..
Is your 'Stripe.php' file really located in '/php' or is it in a folder called 'php' local to your code?
Current code:
require_once('/php/Stripe.php');
I think the problem is this. You probably mean to use something relative to your code base. Like this:
require_once('./php/Stripe.php');
I found out the answer I didn't have the mbstring enabled on my server...whooops

ZF1: E_STRICT messages still appear after disabling

While migrating to a new host with PHP 5.4.x from old host with 5.3.x. I'm stumbling into a problem with E_STRICT.
I know that E_STRICT became part of E_ALL as of PHP 5.4, thus I have disabled it in php.ini.
But I still get an error in combination with Zend_Session, meaning the first page load is ok, I get the frontpage. If I refresh or go to another subpage I get the following error:
Fatal error: Uncaught exception 'Zend_Session_Exception' with message
'Zend_Session::start() -
/var/www/vhost/dev3_domain_com/httpdocs/application/models/someapi.php(
Line:4): Error #2048 Declaration of Someapi::getBeverageSizes() should
be compatible with
My_Service_Someapi::getBeverageSizes($storenumber, $ordertype)
/var/www/vhost/dev3_domain_com/httpdocs/application/models/someapi/Order
.php(Line:1039): Error #2 Creating default object from empty value
/var/www/vhost/dev3_domain_com/httpdocs/application/models/someapi/Order
.php(Line:1039): Error #2 Creating default object from empty value' in
/var/www/vhost/dev3_domain_com/httpdocs/library/Zend/Session.php:490
Stack trace: #0
/var/www/vhost/dev3_domain_com/httpdocs/library/Zend/Session/Namespace.
php(143): Zend_Session::start(true) #1
/var/www/vhost/dev3_domain_com/httpdocs/application/Bootstrap.php(213):
Zend_Session_Namespace->__construct('someapi') #2
/var/www/vhost/dev3_domain_com/httpdocs/library/Zend/Application/
Bootstrap/BootstrapAbstract.php(669): Bootstrap->_initO in
/var/www/vhost/dev3_domain_com/httpdocs/library/Zend/Session.php on line 490
I know I could/should fix my code, but it's quite tedious. The "Someapi" class is extended from "My_Service_Someapi" which in turn is extended from "Zend_Rest_Client" - to handle the webservice from our backend system.
Could it be that Zend Framework sets it's own error reporting? I know from other SO-posts that CakePHP does that.

Mongo/PHP - Connect failure prints plaintext password

If my mongo database is down, my php application is printing out the plaintext password in the error. How can I prevent this?
Fatal error: Uncaught exception 'MongoCursorException' with message
'couldn't send command' in /ap/db.php:23 Stack trace:
#0 /ap/db.php(23): MongoDB->authenticate('username', 'actual_password')
#1 /ap/index.php(6): Worker->__construct() #2 {main} thrown in /ap/db.php
on line 23
I understand that I can disable php errors, but that is not what I want to do. I want to see an error, but I don't want it to print the password.
In a production application, users should never see an error like "Uncaught exception" or other developer-oriented message. This exposes a lot of information to a potential attacker and confuses your legitimate users. Log the detailed technical message and display a friendly error page to the user.
To disable visible errors and log them instead, edit php.ini:
Set error_log to a valid log path
Set display_errors to Off.
The process to enable friendly errors depends on your web server, but the idea is the same: Set a custom page to be displayed when a 500 error is encountered. In Apache, for example, you set ErrorDocument 500 /path/to/custom/500.html.
EDIT :
OP indicates that this is a development box — either way you should wrap your connection attempt in a try/catch block (which is something you should be doing anyway), and then you can display a 'sanitized' error message:
try {
MongoDB->authenticate('username','password');
} catch (MongoCursorException $e) {
die("Unable to authenticate to database [code: " . $e->getCode() . "]: "
. $e->getMessage());
}

how to avoid strace in php

I'm having PHP + MySQL code base. If MySQL is stopped and during log-in it fails like this:
Fatal error: Uncaught exception 'FrameworkException' with message 'Can't connect to local MySQL server through socket '/var/lib/mysql/mysql.sock' (2)' in /var/www/html/classes/class.connection.php:24
Stack trace: #0 /var/www/html/login.php(15): Connection::getInstance('localhost', 'user', '__password', 'DB') #1 /var/www/html/login.php(73): isDataValid('lakshmipathi.g#...', 'test') #2 {main} thrown in /var/www/html/classes/class.connection.php on line 24
How to avoid this stack trace? I want to avoid the username and password displayed like this in case of errors
On a production server you should hide the error with the display_errors directive of your php.ini
The error still be logged but not displayed to the end user.
Turning off the error with error_reporting is not a good idea if you need to debug
Nevertheless you should handle the exception :
try {
//Here the code which can throw an exception
} catch(FrameworkException e) {
echo 'an exception occured';
}
I'd recommend using #mysql_connect (or # + whatever function you call) to suppress any error messages. And manually spit out some error. Since you are using some kind of mysterious framework, you could simply catch the exception.
But, for live environments, you should disable any kind error reporting to the user anyway.

Categories