Re: [SM-PLUGINS] Change_sqlpass and MD5CRYPT

[zamri <my...@gm...>]

On Fri, Nov 21, 2008 at 6:55 AM, Paul Lesniewski <pa...@sq...>wrote:

> On Tue, Nov 4, 2008 at 1:58 AM, Roman Medina-Heigl Hernandez
> <ro...@rs...> wrote:
> > Hello,
> >
> > I've installed last version of change_sqlpass
> > [http://www.squirrelmail.org/plugins/change_sqlpass-3.3-1.2.tar.gz] with
> > Squirrelmail 1.4.9a ("last" from Debian stable) (I also installed last
> > version of compatibility plug-in).
> >
> > I've got it working but I had to slightly modify plug-in source, so I'd
> > like to share with you. Please, tell me if I missed something or it's
> > simply a bug in the plug-in.
> >
> > My passwords are stored in MySQL, using md5crypt. That's the relevant
> part
> > of change_sqlpass config (change_sqlpass/config.php):
> >
> > ========
> > $csp_dsn = 'mysql://postfix_rw:password@localhost/postfix';
> > $lookup_password_query = 'SELECT count(*) FROM user WHERE user = "%1" AND
> > pass = %4';
> > $password_update_queries = array('UPDATE user SET pass = %4 WHERE user =
> > "%1"');
> > $password_encryption = 'MD5CRYPT';
> > $csp_salt_query = 'SELECT SUBSTRING(pass, 4, 8) FROM user WHERE user =
> "%1"';
> > $csp_secure_port = 443;
> > ========
> >
> > If you configure plug-in in that way, you'll get a PHP error stating that
> > the md5crypt() function is undefined. I had a look to plug-in source, and
> > saw the function exists in md5crypt.php file. The error lies on
> > functions.php, where md5crypt() function is called and the cause is that
> > md5crypt.php is not "included". The fix is simple: edit
> > "change_sqlpass/functions.php" and add an "include_once" statement, such
> as:
> >
> >      case strtolower(PASSWORD_ENCRYPTION_MD5CRYPT):
> >         include_once(SM_PATH . 'plugins/change_sqlpass/md5crypt.php');
> >         return '"' . md5crypt($password, $salt) . '"';
> >
> > And now plug-in will work ok :)
> >
> > It seems to me very strange this kind of bug is present in a mature
> > plug-in, so my question is: did I miss something or is it indeed a
> (perhaps
> >  known?) bug?
>
> It's a known bug - an oversight, for which the fix was never released.
>  Your fix is the right one.
>
> Cheers,
> Paul
>
> -------------------------------------------------------------------------
> This SF.Net email is sponsored by the Moblin Your Move Developer's
> challenge
> Build the coolest Linux based applications with Moblin SDK & win great
> prizes
> Grand prize is a trip for two to an Open Source event anywhere in the world
> http://moblin-contest.org/redirect.php?banner_id=100&url=/
> -----
> squirrelmail-plugins mailing list
> Posting guidelines: http://squirrelmail.org/postingguidelines
> List address: squ...@li...
> List archives: http://news.gmane.org/gmane.mail.squirrelmail.plugins
> List info (subscribe/unsubscribe/change options):
> https://lists.sourceforge.net/lists/listinfo/squirrelmail-plugins
>

Will this (the patch) be included in the next plugin update? Just ask to get
confirmation.


-- 
zamri
web : http://muhdzamri.blogspot.com