Newsgroups: php.internals
Path: news.php.net
Xref: news.php.net php.internals:54692
Mailing-List: contact internals-help@lists.php.net; run by ezmlm
Received-SPF: error (pb1.pair.com: domain rile.ca from 208.113.200.5 cause and error)
DomainKey-Status: good
DomainKey-Signature: a=rsa-sha1; c=nofws; d=rile.ca; h=reply-to:from:to:cc
	:references:in-reply-to:subject:date:message-id:mime-version
	:content-type:content-transfer-encoding; q=dns; s=rile.ca; b=ER4
	xW6h9HmaR2cGTXdMcyv1G+3yF1ntpclaV1wzkUW8GzKG4ESetAvJ3kO9FeRxDkkn
	xkzmAlPKFD1dx+FY81CB7ItotgKyUBINlexd6SOn6XoS3nsvmmVAUxzLOCMpQy0S
	OGSCbLDmziAbiXbXCZreo4FvH5vGEoxbNAteKuhQ=
Reply-To: <mike@rile.ca>
To: "'Roger Llopart Pla'" <lumbendil@gmail.com>,
	"'Reindl Harald'" <h.reindl@thelounge.net>
Cc: <internals@lists.php.net>
References: <4E4C44AA.3070302@thelounge.net>	<B8E30524-66A7-4856-9808-8850DD5F8324@welsh.co.nz>	<4E4C4729.5040905@thelounge.net>	<4E4C4F14.5000306@sugarcrm.com>	<4E4C533A.5020909@thelounge.net> <CAAP_MjXReFjxEzMMx2wGJLJ4WW1NFMPvoU+b=q_HQ4e=ygc2TQ@mail.gmail.com>
In-Reply-To: <CAAP_MjXReFjxEzMMx2wGJLJ4WW1NFMPvoU+b=q_HQ4e=ygc2TQ@mail.gmail.com>
Date: Thu, 18 Aug 2011 11:55:18 -0400
Message-ID: <003901cc5dbf$3c9d9a00$b5d8ce00$@ca>
MIME-Version: 1.0
Content-Type: text/plain;
	charset="US-ASCII"
Content-Transfer-Encoding: 7bit
Thread-Index: AcxdOm3jID+yzaa8T2GEHXVYGWzlfgAg0gSw
Content-Language: en-ca
Subject: RE: [PHP-DEV] Autotests: Access denied for user 'root'@'localhost' (using password: NO)
From: mike@rile.ca ("Mike Robinson")

On August-17-11 8:04 PM Roger Llopart Pla wrote:
> That use, or, if it's a development machine, leave it as it is since it
> does it's work just fine.
> 
> 2011/8/18 Reindl Harald <h.reindl@thelounge.net>
> 
> >
> >
> > Am 18.08.2011 01:30, schrieb Stas Malyshev:
> > > Hi!
> > >
> > >> well but using root as default is a little bit crazy
> > >> using user "test" with empty password is acceptable but root????
> > >>
> > >
> > > It's not _that_ root. For mysql, it's just a default user name.
> > > Most people would run it on development machines with mysql
> > > configured not to answer to network, so it's not of a problem
> >
> > it IS THAT root of mysql
> >
> > please do not believe i think it has anything to do with system-root
> > i am doing this job now since ten years :-)
> >
> > using a build/test-server with mysql-driven pure-ftpd and phpmyadmin
> > while having horde-webmail also on the test-machine and you are f**ed
> > with a mysql-root without password
> >
> > the only sense for the default-root without pwd in mysql is to
> > enter "mysql -u root" and set your pwd directly after install


It strikes me that the out-of-the-box test only works on a fresh clean
install of MySQL. The install docs for MySQL strongly recommend changing
that immediately after the install - which I think most people do - so
I doubt very much those are the credentials for the vast majority of
MySQL installs in the world.

I'm wondering if adding a prompt for the mysql username and password,
with the defaults set as is, would be possible, and if so, if someone
were to offer a patch why it shouldn't be considered.

IMHO, if the defaults were used and the tests ran successfully, I'd
be tempted to display a console message along the lines of "your myself
default root credentials are wide open, are you being silly?" 

Best Regards,

Mike Robinson