unuseable ldap auth on v0.96c
VFront is a dynamic front-end for MySQL, PostgreSQL and SQLite DBs.
Status: Beta
Brought to you by:
marciuz
Menu
▾
▴
1 Attachments
#22 unuseable ldap auth on v0.96c
Hi,
I am using vfront v0.96c, and when I linked it to my openLDAP server, I noticed that the LDAP support is unuseable. There are two very wrong things with it:
-
when anonymous_bind is NOT used, then vfront tries to authenticate to the ldap server using the login from $conf_auth['ldap']['bind_user'], but with the password entered by the user, which is unlikely to work.
-
once the initial bind() to the ldap server is done, vfront only check for the presence of the user in the ldap database, for fetching infos (name, mail, etc). But it doesn't verify the user-supplied password at all! This means that I can log in using any existing username + a randomly chosen password, and I will always be able to log in.
I guess the v0.96c version is not maintained anymore, so I might be wasting my time here, but nevertheless, here I attach my patch that solves both problems. I don't know if these problems are present in the svn version - but if so, then it might be a good idea to port my patch to the svn version as well...
Hi Mateusz,
thank you for the bug reporting.
I will fix asap, but at the moment I've some problem with the sourceforge SVN system...
I'll notify you when resolved