bugphpGroupWare - Bugs: bug #23949, header/config passwords containing...

 
 

You are not allowed to post comments on this tracker with your current authentication level.

bug #23949: header/config passwords containing quotes badly managed when magic_quotes

Submitted by:  Olivier Berger <olberger>
Submitted on:  Mon 28 Jul 2008 01:12:48 PM UTC  
 
Item Group: 0.9.16.012Category: API - Setup
Severity: 3 - NormalPriority: 5 - Normal
Status: FixedPrivacy: Public
Assigned to: Dave Hall <skwashd>Open/Closed: Closed
Component Version: DEBOperating System: GNU/Linux - Debian
Reproducibility: Every TimePlanned Release: None
Fixed Release: 

Mon 16 Feb 2009 10:37:18 AM UTC, comment #1:

fix in trunk and will be included in 0.9.16.014

Dave Hall <skwashd>
Project AdministratorIn charge of this item.
Mon 28 Jul 2008 01:12:48 PM UTC, original submission:

Hi.

If I'm not mistaken, whenever one is using PHP5 with magic_quotes (which is the default ?), and header or config password is set to a value where it contains single or double quotes, it's impossible to login in the setup to access the header or config dialogs.

I think that the following code should be changed from :
if($FormPW == stripslashes($GLOBALS['phpgw_info']['server']['header_admin_password']))
to :
if(stripslashes($FormPW) == stripslashes($GLOBALS['phpgw_info']['server']['header_admin_password']))

Hope this helps,

Olivier Berger <olberger>

 

No files currently attached

 

Depends on the following items: None found

Items that depend on this one: None found

 

Carbon-Copy List
  • -unavailable- added by skwashd (Posted a comment)
  • -unavailable- added by olberger (Submitted the item)
  •  

    Do you think this task is very important?
    If so, you can click here to add your encouragement to it.
    This task has 0 encouragements so far.

    Only logged-in users can vote.

     

    Please enter the title of George Orwell's famous dystopian book (it's a date):

     

     

    Follow 4 latest changes.

    Date Changed By Updated Field Previous Value => Replaced By
    Mon 16 Feb 2009 10:37:18 AM UTCskwashdStatusNone=>Fixed
      Assigned toNone=>skwashd
      Open/ClosedOpen=>Closed
      ReproducibilityNone=>Every Time

    Back to the top


    Powered by Savane 3.1-cleanup1