[SOLVED] MySQL PASSWORD() compatibility mode

Hi Folks,

today I’ve got the following information from my hosting company...
Now I’m wondering if this would affect my MODx installs? (I’ve some 1.0.0 and some 1.0.2 installs running.)

In MySQL versions 4.0 and older the function PASSWORD() redelivers a 16-byte
hash value.
Since this value was considered unsafe because of its length the PASSWORD()
function was changed by the developers of the MySQL database that a 41-byte
hash value is redelivered instead from version 4.1.

In order to keep the impact of this change for our customers as small as
possible, a compatibility mode was used until now so the old behavior of
PASSWORD() was also usable in MySQL-4.1 (and later versions) and all
passwords could therefore be stored as 16-byte hash values.

As we want to run our servers as safe as possible which is in your interest,
too, the compatibility mode will be deactivated from 13/01/2010 and the use
of 41-byte hash values will be mandatory. The necessary update process of
our database will be done by us.

If you do not know if your scripts are affected by this change, check your
website files with focus on use of the PASSWORD() function in your database
queries and change this query if necessary to OLD_PASSWORD().

Greetz
JUSI

EDIT: MODx shows me [tt]5.0.32-Debian_7etch11-log[/tt] as the database version. Maybe this is’nt affecting me at all?

got the same one

In order to keep the impact of this change for our customers as small as
possible, a compatibility mode was used until now

not sure, but since MODx requires MYSQL 4.1.20 or higher anyway, we should be fine ( i hope )

It won’t affect you. MODx doesn’t use the MySQL PASSWORD function in any case; it generates its own passwords using the PHP MD5 function.

Thanks a lot for clarifying this susan!

Greetz
JUSI