search

jbroadway / elefant

Elefant, the refreshingly simple PHP CMS and web framework.
http://www.elefantcms.com
MIT License
208 stars 39 forks source link

Bug when setting certain database passwords during install #288

Closed elfuzzo closed 5 years ago

elfuzzo commented 5 years ago

If a database password has '$' as one of the characters, the $ and the character following are filtered out when saving the password during install. This happens on line 163, where file_put_contents() treats $x as a variable at won't write the sequence to the config file. DB password: e#Rm~ej0?Wh+I$6ojY Expected password written to config file: e#Rm~ej0?Wh+I$6ojY Actual password written to config file: e#Rm~ej0?Wh+IojY Maybe '$' characters could be escaped like double-quotes in login passwords are escaped a few lines above (line 160).

jbroadway commented 5 years ago

Thanks for reporting this. What's strange is I tried with a test password of abc$abc"123"123 and it wrote it correctly to the file, but yours strips the $6 out of it for me too so it's not just the $ but apparently dependent on what's after it too. Either way, pushing a fix for it now :)