docs: fix harmful FAQ password reset, dead link, and removed PHP/MySQL features in Windows guide - #214
Conversation
There was a problem hiding this comment.
Pull request overview
Updates Cacti documentation to remove or replace outdated guidance that can break installs or cause account lockouts, focusing on the FAQ and the Windows installation guide.
Changes:
- FAQ: replaces the SQL
md5()password reset guidance with the CLI password reset tool and adds a warning about MD5-based lockouts. - FAQ: replaces a dead external “killspike2” link with the built-in Spikekill documentation link.
- Windows guide: updates MySQL and PHP/IIS configuration guidance to remove MySQL 8–removed settings and replace obsolete PHP ISAPI/php_mysql instructions with PHP 8 FastCGI and mysqli/PDO MySQL extensions.
Reviewed changes
Copilot reviewed 2 out of 2 changed files in this pull request and generated 1 comment.
| File | Description |
|---|---|
| Installing-Under-Windows.md | Removes MySQL 8-incompatible settings; updates PHP extension guidance; replaces IIS ISAPI instructions with FastCGI steps. |
| Frequently-Asked-Questions.md | Replaces harmful password reset instructions and updates spike-removal guidance to use built-in Spikekill docs. |
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
a302495 to
e09e38a
Compare
3bdc08b to
fa92e80
Compare
Refs Cacti#213 Signed-off-by: Thomas Vincent <thomasvincent@gmail.com>
fa92e80 to
8125405
Compare
The prior text pointed at cli/change_password.php, which does not exist in Cacti, and warned that an SQL MD5 update locks the account. Neither is true: compat_password_verify() has an MD5 fallback and re-hashes to bcrypt on the next login, so the SQL reset works. Restore the working SQL method. Signed-off-by: Thomas Vincent <thomasvincent@gmail.com>
|
The IIS step numbering is already sequential (1-6) in the current content, no gap after step 4. No further changes needed; resolving. |
|
@somethingwithproof This has a bigger conflict, but I'm not sure which side of the larger conflict you wish to keep since I think both have been touched by you. |
TheWitness
left a comment
TheWitness
left a comment
There was a problem hiding this comment.
Simple thing. Maybe change to the mariadb command as a nod to those guys who are good with us.
| ```sql | ||
| ```console | ||
| shell> mysql -u root -p cacti | ||
| MySQL> UPDATE user_auth SET password = MD5('newpassword') WHERE username = 'admin'; |
There was a problem hiding this comment.
We need to call out the SHA2() function and only the MD5() function if the SHA2() function is not in their MariaDB version.
There was a problem hiding this comment.
Actually, this really shouldn't matter. Once the user logs in, it is updated by cacti to a more secure one anywa.y
There was a problem hiding this comment.
At least I thought it was, I'm sure we used to do that, it may have been removed from develop as I couldn't spot it quickly.
Closes #213
Summary
Critical -- actively harmful or prevents startup:
md5()SQL password reset withphp cli/change_password.php. Cacti 1.x uses bcrypt/phpass; an MD5 hash set via SQL permanently locks the account even with the correct passwordhttp://cricket.sourceforge.net/contrib/files/killspike2link with reference to the built-in Spikekill utilityNO_AUTO_CREATE_USERfromsql_mode(removed MySQL 8.0; causes startup failure)innodb_file_formatandinnodb_large_prefix(removed MySQL 8.0; cause startup failure)extension=php_mysql.dllwithphp_mysqli.dll+php_pdo_mysql.dll(php_mysqlremoved in PHP 7.0)php8isapi.dlldoes not exist in PHP 8) with correct FastCGI configurationTest plan
php cli/change_password.phpexists and works on current Cacti developsql_mode=NO_ENGINE_SUBSTITUTIONwithoutNO_AUTO_CREATE_USERphp_mysqli.dllandphp_pdo_mysql.dllare present in a standard PHP 8 Windows build