search

littlebizzy / slickstack

Lightning-fast WordPress on Nginx
https://slickstack.io
GNU General Public License v3.0
629 stars 112 forks source link

Special character will be removed in password section. #163

Open bari86 opened 2 years ago

bari86 commented 2 years ago

I am not sure if this is a bug or what, but somehow, for a password, if I enter as:

djasd$*ghr

it will become

djasdghr

This is true for root/sudo password, but I cant remember if its happening with db password or not. it might be for all special characters?

jessuppi commented 2 years ago

Thanks for reporting this @bari86

After reviewing the behavior by trying a complex password string, I found an example result like this in ss-config:

SUDO_PASSWORD="asG$Y#$y3%UW#%U31#@#%#%@SUDO_PASSWORD#%7"

So I thought what's happening is the ss-install wizard's sed commands were not properly delimiting the variables, because we previously weren't using curly brackets. The code is now much better optimized:

Ref: https://github.com/littlebizzy/slickstack/commit/99361db48dd4d24950b7c01767c2f861c8c2a161

However, after I tested again, I saw a similar problem:

Something like 512fa#$W#yW#%yW$%Uw4U%u!!3@$T245&$%&$7%&*^&*685785 ... is changing to like:

512fa#$W#yW#%yW$%Uw4U%u!!3@$T245@SUDO_PASSWORD$%@SUDO_PASSWORD$7%@SUDO_PASSWORD*^@SUDO_PASSWORD*685785

... the & symbol is being replaced with @SUDO_PASSWORD string...

I'm looking into what's causing this demonic behavior, in the meantime all feedback is welcome. Also, for the record, I haven't experienced any "stripping" of special characters like you mentioned originally.

jessuppi commented 2 years ago

Update: in case this is related, we no longer bundle Force Strong Hashing as a MU plugin anymore.

bari86 commented 2 years ago

If this is confirm solved, then the issue can be close.