| Summary | customsql auth driver does not work with encryption schemes using salt |
| Queue | Horde Framework Packages |
| Queue Version | HEAD |
| Type | Bug |
| State | Resolved |
| Priority | 1. Low |
| Owners | Horde Developers (at) , chuck (at) horde (dot) org |
| Requester | dorm (at) dorm (dot) org |
| Created | 04/05/2006 (7098 days ago) |
| Due | |
| Updated | 05/24/2006 (7049 days ago) |
| Assigned | 04/08/2006 (7095 days ago) |
| Resolved | 05/22/2006 (7051 days ago) |
| Github Issue Link | |
| Github Pull Request | |
| Milestone | |
| Patch | No |
@@ -298,7 +298,7 @@
{
/* Retrieve the old password in case we need the salt. */
$query = $this->_params['query_getpw'];
- $query = str_replace('\L', $this->_db->quote($userID), $query);
+ $query = str_replace('\L', $this->_db->quote($userId), $query);
$pw = $this->_db->getOne($query);
if (is_a($pw, 'PEAR_Error')) {
Horde::logMessage($pw, __FILE__, __LINE__, PEAR_LOG_ERR);
--- customsql.php.1.24 2006-05-23 09:43:00.636912864 -0600
+++ customsql.php 2006-05-23 09:48:52.369441392 -0600
@@ -113,7 +113,7 @@
$query = str_replace('\L', $this->_db->quote($userId), $query);
$query = str_replace('\P',
$this->_db->quote($this->getCryptedPassword(
$credentials['password'],
-
$this->_getPassword(),
+
$this->_getPassword($userId),
$this->_params['encryption'],
$this->_params['show_encryption'])), $query);
@@ -298,7 +298,7 @@
{
/* Retrieve the old password in case we need the salt. */
$query = $this->_params['query_getpw'];
- $query = str_replace('\L', $this->_db->quote($oldID), $query);
+ $query = str_replace('\L', $this->_db->quote($userId), $query);
$pw = $this->_db->getOne($query);
if (is_a($pw, 'PEAR_Error')) {
Horde::logMessage($pw, __FILE__, __LINE__, PEAR_LOG_ERR);
State ⇒ Resolved
look in CVS.
New Attachment: customsql.php.1.16.10.8.patch
the user. This can lead to duplicate user accounts in the DB. Not
sure if backends are supposed to do this or not... but admin/users.php
doesn't check, so I thought it would fit here.
Attached is a patch against 1.16.10.8 that fixes both issues in this bug.
State ⇒ Assigned
Priority ⇒ 1. Low
Type ⇒ Bug
Summary ⇒ customsql auth driver does not work with encryption schemes using salt
Queue ⇒ Horde Framework Packages
State ⇒ Unconfirmed
a salt. This is because the salt used for the current encrypted
password is required in order to validate the plaintext password
entered by the user.
customsql.php calls Auth::getCryptedPassword with a salt value of '',
and then authentication fails.
It needs to query the encrypted password from the DB and use that
value in the Auth::getCryptedPassword call. This adds an extra SQL
query, but it is necessary to get the current salt.