| Subject: | MySQL test assumes too much about MySQL behaviour |
| Date: | Tue, 1 Mar 2011 13:30:05 +0000 |
| To: | bug-Crypt-MySQL [...] rt.cpan.org |
| From: | Zefram <zefram [...] fysh.org> |
Crypt-MySQL's test t/03_dbi.t attempts to connect to a local MySQL
instance and check that the module's password hashing matches it.
If the MySQL version is 4.1 or later then it expects MySQL to generate a
new-style (long) password hash, and if it is an earlier version then it
expects MySQL to generate an old-style (short) password hash. This logic
is incorrect, because a 4.1-or-later MySQL can be configured to perform
old-style password hashing. The criteria are described in the MySQL
manual at <http://dev.mysql.com/doc/refman/5.1/en/password-hashing.html>.
I suggest that the test should ignore the MySQL version number, and
just check that what MySQL produces matches *either* C:M:password()
or C:M:password41(). Or, alternatively, drop that test altogether,
in favour of known-answer tests.
-zefram