bugphpGroupWare - Bugs: bug #22811, bad id2name in accounts_ldap...

 
 

You are not allowed to post comments on this tracker with your current authentification level.

bug #22811: bad id2name in accounts_ldap causes bad group memberships

Submitted by:  christian bac <cbac>
Submitted on:  Wed 02 Apr 2008 11:09:18 AM UTC  
 
Item Group: SVN trunk (dev code)Category: API - phpGroupware API
Severity: 3 - NormalPriority: 5 - Normal
Status: NonePrivacy: Public
Assigned to: NoneOpen/Closed: Open
Component Version: NoneOperating System: None
Reproducibility: NonePlanned Release: None
Fixed Release: 

Wed 02 Apr 2008 11:18:00 AM UTC, comment #1:

It should be using id2lid, not id2name which returns the cn. It is basic security that in general other users shouldn't be shown the login ids of other users in potentially hostile environments.

I the resight tree a lot of this stuff has already changed. I think there should be a discussion on the dev list about if this should be fixed now in the phpgw trunk or wait for a sync from resight.

Dave Hall <skwashd>
Project Administrator
Wed 02 Apr 2008 11:09:18 AM UTC, original submission:

group memberships are not well set they contain cn instead of uid.

I think this comes from id2name that uses cn instead of uid.

Here is the diff with my version.

C.Bac

diff class.accounts_ldap.inc.php class.accounts_ldap-chris.inc.php
489c489
< $name = $account['cn'][0];
---

> $name = $account['uid'][0];

christian bac <cbac>

 

No files currently attached

 

Depends on the following items: None found

Items that depend on this one: None found

 

Carbon-Copy List
  • -unavailable- added by skwashd (Posted a comment)
  • -unavailable- added by cbac (Submitted the item)
  •  

    Do you think this task is very important?
    If so, you can click here to add your encouragement to it.
    This task has 0 encouragements so far.

    Only logged-in users can vote.

     

    Please enter the title of George Orwell's famous dystopian book (it's a date):

     

     

    No Changes Have Been Made to This Item

    Back to the top


    Powered by Savane 3.1-cleanup