bugphpGroupWare - Bugs: bug #22811, bad id2name in accounts_ldap...


You are not allowed to post comments on this tracker with your current authentication level.

bug #22811: bad id2name in accounts_ldap causes bad group memberships

Submitted by:  - <_66106>
Submitted on:  Wed 02 Apr 2008 11:09:18 AM UTC  
Category:  API - phpGroupware API Item Group:  SVN trunk (dev code)
Severity:  3 - Normal Priority:  5 - Normal
Status:  None Privacy:  Public
Assigned to:  None Open/Closed:  Open
Component Version:  None Operating System:  None
Reproducibility:  None Planned Release:  None
Fixed Release: 

Wed 02 Apr 2008 11:18:00 AM UTC, comment #1: 

It should be using id2lid, not id2name which returns the cn.  It is basic security that in general other users shouldn't be shown the login ids of other users in potentially hostile environments.

I the resight tree a lot of this stuff has already changed.  I think there should be a discussion on the dev list about if this should be fixed now in the phpgw trunk or wait for a sync from resight.

Dave Hall <skwashd>
Project Administrator
Wed 02 Apr 2008 11:09:18 AM UTC, original submission:  

group memberships are not well set they contain cn instead of uid.

I think this comes from id2name that uses cn instead of uid.

Here is the diff with my version.


diff class.accounts_ldap.inc.php class.accounts_ldap-chris.inc.php
< $name = $account['cn'][0];

> $name = $account['uid'][0];

- <_66106>


No files currently attached


Depends on the following items: None found

Items that depend on this one: None found


Carbon-Copy List
  • -email is unavailable- added by skwashd (Posted a comment)
  • -email is unavailable- added by _66106 (Submitted the item)

    Do you think this task is very important?
    If so, you can add your encouragement to it.
    This task has 0 encouragements so far.

    Only logged-in users can vote.




    No changes have been made to this item

    Back to the top

    Powered by Savane 3.5