hhf/MySQLTuner-perl
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

Fix SQL string concatenation in capitalization during password test

Browse source
This commit is contained in:
Peter 'Pessoft' Kolínek 2016-08-24 00:21:18 +02:00
parent 16046e2c19
commit 70455de4ba
1 changed files with 4 additions and 4 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

8
mysqltuner.pl
View file

@ -1483,7 +1483,7 @@ sub security_recommendations {
# Looking for User with user/ uppercase /capitalise user as password # Looking for User with user/ uppercase /capitalise user as password
@mysqlstatlist = select_array @mysqlstatlist = select_array
"SELECT CONCAT(user, '\@', host) FROM mysql.user WHERE CAST($PASS_COLUMN_NAME as Binary) = PASSWORD(user) OR CAST($PASS_COLUMN_NAME as Binary) = PASSWORD(UPPER(user)) OR CAST($PASS_COLUMN_NAME as Binary) = PASSWORD(UPPER(LEFT(User, 1)) + SUBSTRING(User, 2, LENGTH(User)))"; "SELECT CONCAT(user, '\@', host) FROM mysql.user WHERE CAST($PASS_COLUMN_NAME as Binary) = PASSWORD(user) OR CAST($PASS_COLUMN_NAME as Binary) = PASSWORD(UPPER(user)) OR CAST($PASS_COLUMN_NAME as Binary) = PASSWORD(CONCAT(UPPER(LEFT(User, 1)), SUBSTRING(User, 2, LENGTH(User))))";
if (@mysqlstatlist) { if (@mysqlstatlist) {
foreach my $line ( sort @mysqlstatlist ) { foreach my $line ( sort @mysqlstatlist ) {
chomp($line); chomp($line);
@ -1528,12 +1528,12 @@ sub security_recommendations {
. $pass . $pass
. "') OR $PASS_COLUMN_NAME = PASSWORD(UPPER('" . "') OR $PASS_COLUMN_NAME = PASSWORD(UPPER('"
. $pass . $pass
. "')) OR $PASS_COLUMN_NAME = PASSWORD(UPPER(LEFT('" . "')) OR $PASS_COLUMN_NAME = PASSWORD(CONCAT(UPPER(LEFT('"
. $pass . $pass
. "', 1)) + SUBSTRING('" . "', 1)), SUBSTRING('"
. $pass . $pass
. "', 2, LENGTH('" . "', 2, LENGTH('"
. $pass . "')))"; . $pass . "'))))";
debugprint "There is " . scalar(@mysqlstatlist) . " items."; debugprint "There is " . scalar(@mysqlstatlist) . " items.";
if (@mysqlstatlist) { if (@mysqlstatlist) {
foreach my $line (@mysqlstatlist) { foreach my $line (@mysqlstatlist) {