Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Mysql and MariaDB Compatibility issues for password function #779

Closed
wants to merge 1 commit into from

Conversation

MuchQuak
Copy link
Collaborator

@MuchQuak MuchQuak commented Dec 14, 2023

…(SHA1(?))))) which is a drop in replacement and hash the same values

This function was depericated due to concerns about security regarding password replace of mysql users not general purpose hashing security. So this replace should be fine and doesn't require a package or 3rd party solution for now.

Pull Request Checklist:

Pre-Approval

  • There is a description section in the pull request that details what the proposed changes do. It can be very brief if need be, but it ought to exist.
  • Hotfixes should be branched off of the master branch and squash and merged back into the master branch.
  • Features and backlog bugs should be merged into the Development branch, NOT master
  • All new text is preferably internationalized (i.e., no end-user-visible text is hard-coded on the PHP pages)
  • There are no linter errors
  • New features have responsive design (i.e., look aesthetically pleasing both full screen and with small or mobile screens)
  • Symbiota coding standards have been followed
  • If any files have been reformatted (e.g., by an autoformatter), the reformat is its own, separate commit in the PR
  • Comment which GitHub issue(s), if any does this PR address
  • If this PR makes any changes that would require additional configuration of any Symbiota portals outside of the files tracked in this repository, make sure that those changes are detailed in this document.

Post-Approval

  • It is the code author's responsibility to merge their own pull request after it has been approved
  • If this PR represents a merge into the Development branch, remember to use the squash & merge option
  • If this PR represents a merge from the Development branch into the master branch, remember to use the merge option
  • If this PR represents a hotfix into the master branch, a subsequent PR from master into Development should be made merge option (i.e., no squash).
  • If the dev team has agreed that this PR represents the last PR going into the Development branch before a tagged release (i.e., before an imminent merge into the master branch), make sure to notify the team and lock the Development branch to prevent accidental merges while QA takes place. Follow the release protocol here.
  • Don't forget to delete your feature branch upon merge. Ignore this step as required.

Thanks for contributing and keeping it clean!

Summary

There is compatibility issues with MySQL and MariaDB because the password() function in MySQL has been deprecated for a while see (MySQL Password Deprication)[https://dev.mysql.com/worklog/task/?id=6409] as to why. The TLDR is that the password() function was used to set MySQL user passwords and that was generally and unsafe practice to encourage because of SQL injection. However in our use case of just hashing a password for a user account I don't think any of this concern is warranted and SHA1 is a decent encryption technique so we should be good in that department.

Solution

Solution is a swap from the password function to the direct usage of hashing function.
So from this

PASSWORD('mypass')

to this

CONCAT('*', UPPER(SHA1(UNHEX(SHA1('mypass')))))

…(SHA1(?))))) which is a drop in replacement and hash the same values

This function was depericated due to concerns about security regarding password replace of mysql users not general purpose hashing security. So this replace should be fine and doesn't require a package or 3rd party solution for now.
@MuchQuak MuchQuak requested a review from egbot December 14, 2023 22:21
@MuchQuak MuchQuak changed the title replacing mysql function password with CONCAT(\'*\', UPPER(SHA1(UNHEX… Mysql and MariaDB Compatibility issues for password function Dec 14, 2023
@MuchQuak MuchQuak closed this Dec 20, 2023
@MuchQuak MuchQuak mentioned this pull request Dec 20, 2023
16 tasks
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

2 participants