Tickets :: Comment on [#14467] authLockUser method missing

* Your Email Address
* Spam protection	Enter the letters below: __ . .. ..__.. . / `\|_/ \|\ \|\| \|\ / \__.\| \\| \\|\|__\ \/
Comment	> > Yes, something doesn't look right there. > Horde_Core_Auth_Application::lockUser is an override of > Horde_Auth_Base::lockUser. It looks like it was added to give > applications the ability to provide their own method of locking users > - though none of our applications seem to implement this. > > The 'lock' capability is set if the 'lock_api' parameter is passed > when contructing an Auth object, and this is done when the > 'login_block' parameter is set in the config. Now, the > hasCapability() method is called in > Horde_Core_Auth_Application::lockUser - the > Horde_Core_Auth_Application::hasCapability method explicitly states > that the 'lock' ability is determined by "Horde", and NOT by > applications - yet, when that check is true, we call the application > method. That is broken. If we truly want to allow the applications to > provide their own lock mechanisms we need to first check the > appCapability, and if that fails, then check Horde.
Attachment
Watch this ticket