-
Problem report
-
Resolution: Fixed
-
Blocker
-
6.0.31rc1, 6.4.16rc1, 7.0.0rc2
-
Prev.Sprint, S24-W32/33, S24-W34/35, S24-W36/37, S24-W38/39, S24-W40/41, S24-W42/43, S24-W44/45
-
0.5
Problem description: If the user inserts a utf8mb4 smiley into the login field in user login form, then a failed SQL statement is returned in the error message, in case if Zabbix, that works with a MySQL database, is compiled without utf8mb4 support:
Steps to reproduce:
- Setup zabbix with MySQL without utf8mb4 support
- Open login page
- Insert a smiley into the login field (for example 🔥 or ðŸŒ)
- Press "Sign in" button
Result: The failed query is displayed in the error message (see the above screenshot)
Expected: Same as in case of PostgreSQL, we shouldnot expose such information as table structure to users that are not even logged in. Expected error message:
Incorrect user name or password or account is temporarily blocked.