From 2deb3dbea703850ac9fc5d345b9b3a900a92054a Mon Sep 17 00:00:00 2001 From: eileenmcnaugton Date: Mon, 29 Feb 2016 19:49:26 +1300 Subject: [PATCH] Display malformed sql in test failures (yes, it might be the permission should be reviewed too as more nuanced options exist now but leaving that out of scope) --- api/v3/utils.php | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/api/v3/utils.php b/api/v3/utils.php index 1d67d91204..3cd75f7a66 100644 --- a/api/v3/utils.php +++ b/api/v3/utils.php @@ -131,9 +131,10 @@ function civicrm_api3_verify_mandatory($params, $daoName = NULL, $keys = array() function civicrm_api3_create_error($msg, $data = array()) { $data['is_error'] = 1; $data['error_message'] = $msg; + // we will show sql to privileged user only (not sure of a specific // security hole here but seems sensible - perhaps should apply to the trace as well?) - if (isset($data['sql']) && CRM_Core_Permission::check('Administer CiviCRM')) { + if (isset($data['sql']) && (CRM_Core_Permission::check('Administer CiviCRM') || CIVICRM_UF == 'UnitTests')) { // Isn't this redundant? $data['debug_information'] = $data['sql']; } -- 2.25.1