Re: [SM-USERS] truncated password in imap server

[Gianni M. <gi...@ma...>]

>Not likely, everybody would be affected by it otherwise. I vaguely
>remember an issue in an old PHP version (which you didn't mention,
>along with your web server) that truncates inputted strings depending
>on a very specific setup. This issue was resolved in a later release,
>and certainly shouldn't be in anything higher than 4.3.2 if I remember
>correctly (though the info is sketchy in my memory).
>  
>
Here is an example, I set the password to "testpw" and squirrelmail 
passes only "tes"

Sep  7 02:06:02 www imapd: LOGIN: DEBUG: ip=[::ffff:127.0.0.1], 
command=LOGIN
Sep  7 02:06:02 www imapd: LOGIN: DEBUG: ip=[::ffff:127.0.0.1], 
username=USERNAME_HERE
Sep  7 02:06:02 www imapd: LOGIN: DEBUG: ip=[::ffff:127.0.0.1], password=tes

adding 'zzz' to the end of the pw shows the rest of it:
Sep  7 02:07:46 www imapd: LOGIN: DEBUG: ip=[::ffff:127.0.0.1], 
command=LOGIN
Sep  7 02:07:46 www imapd: LOGIN: DEBUG: ip=[::ffff:127.0.0.1], 
username=USERNAME_HERE
Sep  7 02:07:46 www imapd: LOGIN: DEBUG: ip=[::ffff:127.0.0.1], 
password=testpwzzz

adding only 1 z does this:
Sep  7 02:08:41 www imapd: LOGIN: DEBUG: ip=[::ffff:127.0.0.1], 
command=LOGIN
Sep  7 02:08:41 www imapd: LOGIN: DEBUG: ip=[::ffff:127.0.0.1], 
username=USERNAME_HERE
Sep  7 02:08:41 www imapd: LOGIN: DEBUG: ip=[::ffff:127.0.0.1], 
password=testp

adding a single '1' character at the end of the pw does this:
Sep  7 02:09:54 www imapd: LOGIN: DEBUG: ip=[::ffff:127.0.0.1], 
command=LOGIN
Sep  7 02:09:54 www imapd: LOGIN: DEBUG: ip=[::ffff:127.0.0.1], 
username=USERNAME_HERE
Sep  7 02:09:54 www imapd: LOGIN: DEBUG: ip=[::ffff:127.0.0.1], 
password=testpw
... and then I can successfully log in.


Apache/1.3.27 (Unix) (Red-Hat/Linux)
mod_jk/1.2.0
mod_perl/1.26
PHP/4.2.2
FrontPage/5.0.2
mod_ssl/2.8.12
OpenSSL/0.9.6b

I don't think I can upgrade php just yet...

Again, using egroupware's email client worked just fine with exactly the 
same setup.