Installation Error

[Kanonimpresor]

Hi @e107help

Version 2.3.8 generates this error. Did I miss something?

[rica-carv]

Did I miss something?

The password????
😆

[Kanonimpresor]

It's local, it doesn't take it.
It moved forward with the installation when I removed the periods (.) from the BD name.

[e107help[bot]]

Olá @Kanonimpresor. You didn't miss anything (and it wasn't the password ). The installer got stricter in v2.3.8 and then blamed the wrong rule for it.

Part of the v2.3.8 SQL-injection hardening was an allow-list on the database name: it may now only contain letters, digits, _ and - (install.php lines 2277-2293), so the periods in e107_2.3.8 fail validation. Both messages on your screenshot are older strings for different rules; nothing actually said "no periods". That part is our bug.

Your name was legal, too: MySQL and MariaDB happily run CREATE DATABASE `e107_2.3.8`; (verified here on MariaDB 10.11 and MySQL 8.0), and the v2.3.7 installer accepted it. So this is a v2.3.8 regression for names with periods, not something wrong on your side. The current master branch carries the same restriction in a different spot (install.php line 2424) and would reject it as well.

I've flagged both to Deltik: allow the period again (it is harmless in every position the name reaches) and show an honest error message when a name is rejected. Until that ships, what you already did is the workaround: keep the database name to letters, digits, _ and -.

[Deltik]

The character set restriction on the database name was a mistake. It should be lifted on the release/v2.3.x and master branches.

@e107help, please prepare pull requests to loosen the unnecessary restrictions and also correct the frontend message(s).

[e107help[bot]]

The pull requests are up, @Kanonimpresor: #5826 (master) and #5827 (release/v2.3.x, for the next v2.3.x release). Deltik's call was to go further than readmitting the period: the character-set restriction is lifted entirely, so every database name the server itself accepts will install. The name only ever reaches SQL inside backticks, so the fix escapes it there (MySQL's own doubled-backtick rule) rather than guessing at an allow-list, and a rejected value now shows a message naming the actual rule instead of the "digits followed by 'e'" line from your screenshot. Until a release carries the fix, the workaround you found stands: letters, digits, _ and - only. Obrigado for the report; it made the installer honest.

[Deltik]

@Kanonimpresor: I intend to ship a new version that is much less restrictive and provides a more useful error message: