I use mapserver 7.0.2 to display Points which are taken from a MYSQL-database. If the the SQL-statement fails (for example the database can't be reached) the mapserver gives out an OGR error-message, revealing the entire SQL-statement including user and password.
msDrawMap(): Image handling error. Failed to draw layer named '....'. msOGRFileNextShape(): OGR error. MySQL connect failed for: .....,user=.....,password=....,host=....,port=...,tables=..... Access denied for user '........' (using password: YES)
Is there a way to disable these exceptions? I already tried the msencrypt feature to encrypt the password, but it does not affect the exception text.
This shows how i connect to the DB in the mapfile:
CONNECTION "<OGRVRTDataSource> <OGRVRTLayer name='....'> <SrcDataSource>MYSQL:....,user=....,password=....,host=....,port=....,tables=....</SrcDataSource> <SrcSQL> SELECT .... FROM .... WHERE .... </SrcSQL> <GeometryType>wkbPoint</GeometryType> <GeometryField encoding='PointFromColumns' x='....' y='....'/> </OGRVRTLayer> </OGRVRTDataSource>"
I have these problems on my CentOS installation. I just checked if this problem also occurs on MS4W and here its a bit different:
msDrawMap(): Image handling error. Failed to draw layer named '....'. msOGRFileNextShape(): OGR error. MySQL connect failed for: geobase,user=root,password=XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX connect to MySQL server on 'localhost' (10061)
It still prints the user (when with problem server / login) and the SQL-Statement (when the statement fails) but on ms4w it masks the password with XXXXXXXXX... which is alot better than printing it.