Error Handling: Need improvements to database error handling

[jburns131]

The error handling could be improved when a database exists but does not contain tables.

For MySQL:

If there is already a database but no tables then $rbac->reset(true) returns true, even though no tables are created and no data is inserted.

I think there should either be a check to make sure that reset() actually inserted data into the database or a check to make sure that the tables have been created prior to executing reset(). This does sound like it could be resource intensive if we're checking for an existing database and existing tables inside 'setup.php'.

For MySQLi:

Same issue, but php sends warnings and errors on its own.

For SQLite:

Still need to test with an empty database.

[jburns131]

Notes:

• Jf.php: Line 149 - I think we should change the 'trigger_error' to a thrown Exception in order to improve error handling. If not then we should at least stop script execution on the next like using 'exit' or 'die' ('exit' seems more appropriate as the triggered error contains an error message).

[jburns131]

@abiusx:

I think I've found the reason why 'RbacManager::reset()' always returns true.

rbac.php: Lines 669 - 673
Link: https://github.com/OWASP/rbac/blob/master/PhpRbac/src/PhpRbac/core/lib/rbac.php#L669

This block uses the operator 'and' rather than '&&'.

If we look at this PHP Manual Page, we can see the differences between 'and' and '&&'.

and

    // The constant true is assigned to $h and then false is ignored
    // Acts like: (($h = true) and false)
    $h = true and false;

&&

    // The result of the expression (true && false) is assigned to $g
    // Acts like: ($g = (true && false))
    $g = true && false;

Since '$res' is initialized as 'true' and the 'and' operator is used, '$res' will never be anything but 'true'.

Please take a look at this and let me know if I'm missing something,

Thanks!