Installation: Froxlor database user is created with deprecated mysql_native_password

[realrellek]

Describe the bug Installing froxlor from scratch (2.1.3 on Bookworm) leads to the creation of a froxlor database (obviously) with a froxlor database user.

Said user is created using mysql_native_password which is hardcoded: https://github.com/Froxlor/Froxlor/blob/ea31c8a64dc15d3591a440ef9bf617c895ea162c/lib/Froxlor/Install/Install/Core.php#L320

And that is deprecated in current (oracle) MySQL (8.0.35 at the time of writing) 2023-12-29T14:26:39.037186Z 15 [Warning] [MY-013360] [Server] Plugin mysql_native_password reported: ''mysql_native_password' is deprecated and will be removed in a future release. Please use caching_sha2_password instead'

System information

• Froxlor version: 2.1.3
• Web server: apache2
• DNS server: nuttin
• POP/IMAP server: Dovecot
• SMTP server: postfix
• FTP server: proftpd
• OS/Version: Debian 11 Bookworm

To Reproduce

• Install MySQL from Oracle's APT repo: https://dev.mysql.com/downloads/repo/apt/
• Install froxlor (I did from tarball)
• MySQL user "froxlor" (or however you called em) is using mysql_native_password
• Restart MySQL (or don't, can't remember tbh) to have quite some logs in /var/log/mysql/error.log

Expected behavior Guess it should not specify the plugin so it uses whatever is standard in MySQL at the time?

Logfiles See above

Additional context That's about it :)

[d00p]

need to test whether it works without any plugin specified, i remember there was a reason for distinguishing mariadb and mysql >= 8.0.11

[realrellek]

Maybe that is done because MariaDB does not support this new default for MySQL. https://mariadb.com/kb/en/authentication-plugin-sha-256/

But I wonder why not just "not specifying" the plugin and relying on MariaDB's/MySQL's default instead. Because why would we care?

It also is the only user that is created with the native plugin (i.e. none of the customer db users are native but caching_sha2_password), so I guess when creating the customer db user, it relies on the default.

Well now that I write it, I might have another theory on how this code could have landed in the installer. Maybe 8.0.11 was the point when MySQL switched the default to caching_sha2_password and the idea was to keep users interchangeable with MariaDB and thus specifying the old plugin.