Page MenuHomePhabricator

Command-line installer generates faulty LocalSettings.php file when DB password contains $ (dollar sign)
Closed, ResolvedPublicBUG REPORT

Description

Steps to replicate the issue:

  • Run install.php maintenance script with --dbpass option providing a value that contains a $ (dollar sign) (e.g. abc$def)

What happens?
The generated LocalSettings.php contains the line:

$wgDBpassword = "abc$def";

This causes an error, since $def is not escaped.

What should have happened instead?
The generated LocalSettings.php should contain:

$wgDBpassword = 'abc$def';

Note the single quotes (') rather than double quotes (")

Software version:
MediaWiki versions since roughly 2010 up to present

Details

Event Timeline

Change 990370 had a related patch set uploaded (by Cicalese; author: Cicalese):

[mediawiki/core@master] Change " to ' for values that may need to escape $

https://gerrit.wikimedia.org/r/990370

Change 990370 merged by jenkins-bot:

[mediawiki/core@master] Change " to ' for values that may need to escape $

https://gerrit.wikimedia.org/r/990370

Just happened something similar today while installing MediaWiki 1.42.1.

I ran the installation script, it asked for the user DB password (it contained a $ sign) and went on smoothly right to the end. I checked through phpMyAdmin and all tables were created (or better... a lot of tables were created, I didn't check the exact set of table had been created)

When I tried to access the wiki the first time it complained:

Cannot access the database: Access denied for user 'foo'@'localhost' (using password: YES) (localhost)

Looking at the LocalSettings.php I found

$wgDBpassword = 'abc\$def';

The "\" was not part of my password, it was added during the installation phase.

I removed the "\" and the problem was solved.

Some more information about my installation:

  • MediaWiki 1.42.1
  • PHP 8.1.29 (cgi-fcgi)
  • ICU 69.1
  • MySQL 8.0.37

Regards,
Massimiliano

The fix for this causes T372569.

Looking at the LocalSettings.php I found

$wgDBpassword = 'abc\$def';

The "\" was not part of my password, it was added during the installation phase.

I removed the "\" and the problem was solved.

I think based on this it seems the fix might not be working correctly or fully. I have not tested

This should (hopefully) no longer be an issue