Mysql and MariaDB Compatibility issues for password function #779
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
…(SHA1(?))))) which is a drop in replacement and hash the same values
This function was depericated due to concerns about security regarding password replace of mysql users not general purpose hashing security. So this replace should be fine and doesn't require a package or 3rd party solution for now.
Pull Request Checklist:
Pre-Approval
master
branch and squash and merged back into themaster
branch.Development
branch, NOTmaster
Post-Approval
Development
branch, remember to use the squash & merge optionDevelopment
branch into the master branch, remember to use the merge optionmaster
branch, a subsequent PR frommaster
intoDevelopment
should be made merge option (i.e., no squash).Development
branch before a tagged release (i.e., before an imminent merge into the master branch), make sure to notify the team and lock theDevelopment
branch to prevent accidental merges while QA takes place. Follow the release protocol here.Thanks for contributing and keeping it clean!
Summary
There is compatibility issues with MySQL and MariaDB because the
password()
function in MySQL has been deprecated for a while see (MySQL Password Deprication)[https://dev.mysql.com/worklog/task/?id=6409] as to why. The TLDR is that thepassword()
function was used to set MySQL user passwords and that was generally and unsafe practice to encourage because of SQL injection. However in our use case of just hashing a password for a user account I don't think any of this concern is warranted and SHA1 is a decent encryption technique so we should be good in that department.Solution
Solution is a swap from the password function to the direct usage of hashing function.
So from this
PASSWORD('mypass')
to this