Tickets :: Comment on [#11791] Horde_Auth_Ldap::updateUser() calls Horde

* Your Email Address
* Spam protection	Enter the letters below: . .. .. . ..__ \ /\|\ \|\|__\| \|[__) \/ \| \\|\| \|\__\|\| \
Comment	> I did some short tests and it works if $olddn is null. > > > I did not test the case $olddn != null, but reviewing the code it > behaves very different: > > * It calls $this->_ldap->move($olddn, $newdn) if ($oldID != $newID), but > - does no check if $newdn is actually a DN > - does not ensure that $oldID refers to the same user as $olddn > - does not ensure that $newID refers to the same user as $newdn > > * it uses complete $credentials for the new $entry but does not check > if only credentials are in it > > * it does not hash the password > > * it does not check shadowmin > > * it does not set shadowlastchange
Attachment
Watch this ticket