Unable to install

[msfrog]

I'm trying to install the latest version 2.11.0 Rev 78. But whenever I click Install, I end up with the same error:
Error: [048] Access denied for user 'xxxx'@'localhost' (using password: YES)

The credentials are correct, I checked it at least 10 times and logged in via mysql command line tool. The log files are of no help, php.log doesn't show anything regarding this problem and mysql.log just repeats the same error I see on the screen. I'm out of ideas now. Can anyone help?

PHP version: 7.0.25-0ubuntu0.16.04.1
MySQL version: 5.7.21-0ubuntu0.16.04.1 - (Ubuntu)

[dbs]

Hi, you are sure that localhost is the right host?
Some hoster have there another host.

[msfrog]

Since this is my own server... Yes, I'm sure about that. But thank you for the suggestion.

[Gast]

Error: [048] Access denied for user 'xxxx'@'localhost' (using password: YES)

is not a WB-Error message, it come's directly from the SQL-Server and means, that you use the wrong datas for this database (Host, Username, Password)

[msfrog]

I know this error comes from MySQL. But I retyped it a lot and checked it on the command line - the data is definitely correct. I still had the install files from 2.10.0 and just tried it, this works. So I suppose there must be something wrong with the files from 2.11.0. Maybe the password is not given to the MySQL server correctly?

[msfrog]

Ok, now I can tell that this is definitely a bug of the install script. The password gets changed. I guess this happens in save.php line 155:
$aInputs[$key] = preg_replace('/[^a-z0-9_-]/i', '', Sanitize::StripFromText($aValue,31));

As far as I understand the regular expression, it deletes everything but letters, numbers, _ and - from the given string. My MySQL password contains characters other than that, so it doesn't work.

Edit:
I replaced "$aInputs[$key] = preg_replace('/[^a-z0-9_-]/i', '', Sanitize::StripFromText($aValue,31));" with "$aInputs[$key] = $aValue;" to check if I'm right. With this line it works, so it must be either the regular expression or the Sanitize part of this line. I'm not that good at regexp, adding \. after the - resulted in various other errors. Please help

[Gast]

to explain it......... we received a security warning about the input fields in the installer. The only way to solve the problem is to check the inserted characters, but it looks like we forgot the separate regex for the password check. In this case, the check is set to the standard check method with the allowed characters a-z, 0-9, _ -.

we need a little time to find some official information and a solution for everyone.

Your solution doesn't have a check for hostname, DB username and DB name, so it's a little dangerous - but it works in this case, because this check is only used in the installation - it's not possible to restart this process or start it from the outside.

Translated with www.DeepL.com/Translator

[msfrog]

I'm aware of the danger, I just did it to confirm that the given line is causing the problem and it was the easiest way of testing this I could think of. It wasn't meant to be a fix