Tickets :: Comment on [#10211] Login successes despite wrong username with composite authentication

* Your Email Address
* Spam protection	Enter the letters below: .__ . .__ . .. . \| \\| [__)\ /\ / \|__/\|___\| \/ \/
Comment	> When using composite authentication, letting IMP handle > authentication and using SQL as admin-driver, you can login with any > username/password-combination. > > To reproduce use following configuration: > $conf['auth']['driver'] = 'composite'; > > $conf['auth']['params']['admin_driver']['driver'] = 'sql'; > $conf['auth']['params']['admin_driver']['params']=array( > "driverconfig"=>"horde" > ); > > $conf['auth']['params']['auth_driver']['driver'] = 'application'; > $conf['auth']['params']['auth_driver']['params'] =array( > "app"=>"imp" > ); > > Then login with any username and password. > >
Attachment
Watch this ticket