xref: /PHP-8.1/ext/mysqli/tests/gh11438.phpt (revision 162bd2a5)
1--TEST--
2GH-11438 (mysqlnd fails to authenticate with sha256_password accounts using passwords longer than 19 characters)
3--EXTENSIONS--
4mysqli
5--SKIPIF--
6<?php
7require_once 'skipifconnectfailure.inc';
8
9ob_start();
10phpinfo(INFO_MODULES);
11$tmp = ob_get_contents();
12ob_end_clean();
13if (!stristr($tmp, "auth_plugin_sha256_password"))
14    die("skip SHA256 auth plugin not built-in to mysqlnd");
15
16if (!$link = my_mysqli_connect($host, $user, $passwd, $db, $port, $socket))
17    die(printf("skip: [%d] %s\n", mysqli_connect_errno(), mysqli_connect_error()));
18
19if (mysqli_get_server_version($link) < 50606)
20    die("skip: SHA-256 requires MySQL 5.6.6+");
21
22if (!($res = $link->query("SHOW PLUGINS"))) {
23    die(sprintf("skip [%d] %s\n", $link->errno, $link->error));
24}
25
26$found = false;
27while ($row = $res->fetch_assoc()) {
28    if (($row['Name'] == 'sha256_password') && ($row['Status'] == 'ACTIVE')) {
29        $found = true;
30        break;
31    }
32}
33if (!$found)
34    die("skip SHA-256 server plugin unavailable");
35
36// Ignore errors because this variable exists only in MySQL 5.6 and 5.7
37$link->query("SET @@session.old_passwords=2");
38
39$link->query('DROP USER shatest');
40$link->query("DROP USER shatest@localhost");
41
42if (!$link->query('CREATE USER shatest@"%" IDENTIFIED WITH sha256_password') ||
43    !$link->query('CREATE USER shatest@"localhost" IDENTIFIED WITH sha256_password')) {
44    die(sprintf("skip CREATE USER failed [%d] %s", $link->errno, $link->error));
45}
46
47// Password of length 52, more than twice the length of the scramble data to ensure scramble is repeated correctly
48if (!$link->query('SET PASSWORD FOR shatest@"%" = "abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ"') ||
49    !$link->query('SET PASSWORD FOR shatest@"localhost" = "abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ"')) {
50    die(sprintf("skip SET PASSWORD failed [%d] %s", $link->errno, $link->error));
51}
52
53echo "nocache";
54?>
55--FILE--
56<?php
57require_once 'connect.inc';
58
59$link = new mysqli($host, 'shatest', 'abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ', null, $port, $socket);
60if ($link->connect_errno) {
61    printf("[001] [%d] %s\n", $link->connect_errno, $link->connect_error);
62} else {
63    if (!$res = $link->query("SELECT USER()"))
64        printf("[002] [%d] %s\n", $link->errno, $link->error);
65
66    if (!$row = mysqli_fetch_assoc($res)) {
67        printf("[003] [%d] %s\n", $link->errno, $link->error);
68    }
69
70    if (!is_string($row['USER()']) || !str_starts_with($row['USER()'], 'shatest')) {
71        printf("[004] Expecting 1 got %s/'%s'", gettype($row['USER()']), $row['USER()']);
72    }
73}
74
75print "done!";
76?>
77--CLEAN--
78<?php
79require_once 'connect.inc';
80if (!$link = my_mysqli_connect($host, $user, $passwd, $db, $port, $socket)) {
81    printf("[clean] Cannot connect to the server using host=%s, user=%s, passwd=***, dbname=%s, port=%s, socket=%s\n",
82        $host, $user, $db, $port, $socket);
83}
84$link->query('DROP USER shatest');
85$link->query('DROP USER shatest@localhost');
86?>
87--EXPECTF--
88done!
89