bugphpGroupWare - Bugs: bug #22811, bad id2name in accounts_ldap...

 
 

You are not allowed to post comments on this tracker with your current authentication level.

bug #22811: bad id2name in accounts_ldap causes bad group memberships

Submitter:  - <_66106>
Submitted:  Wed 02 Apr 2008 11:09:18 AM UTC
 
Item Group:  SVN trunk (dev code) Category:  API - phpGroupware API
Severity:  3 - Normal Priority:  5 - Normal
Status:  None Privacy:  Public
Assigned to:  None Open/Closed:  Open
Component Version:  None Operating System:  None
Reproducibility:  None Planned Release:  None
Fixed Release: 

Wed 02 Apr 2008 11:18:00 AM UTC, comment #1: 

It should be using id2lid, not id2name which returns the cn.  It is basic security that in general other users shouldn't be shown the login ids of other users in potentially hostile environments.

I the resight tree a lot of this stuff has already changed.  I think there should be a discussion on the dev list about if this should be fixed now in the phpgw trunk or wait for a sync from resight.

Dave Hall <skwashd>
Project Administrator
Wed 02 Apr 2008 11:09:18 AM UTC, original submission:  

group memberships are not well set they contain cn instead of uid.

I think this comes from id2name that uses cn instead of uid.

Here is the diff with my version.

C.Bac

diff class.accounts_ldap.inc.php class.accounts_ldap-chris.inc.php
489c489
< $name = $account['cn'][0];
---

> $name = $account['uid'][0];

- <_66106>

 

(Note: upload size limit is set to 16384 kB, after insertion of the required escape characters.)

No files currently attached

 

Depends on the following items: None found

Items that depend on this one: None found

 

Carbon-Copy List
  • -email is unavailable- added by skwashd (Posted a comment)
  • -email is unavailable- added by _66106 (Submitted the item)
  •  

    There are 0 votes so far. Votes easily highlight which items people would like to see resolved in priority, independently of the priority of the item set by tracker managers.

     

     

     

    No changes have been made to this item

    Back to the top


    Powered by Savane 3.9