bugweb-cyradm - Bugs: bug #12102, Changing password for...

 
 

bug #12102: Changing password for <UserName> (from domain D1) changes passwords for all users named <UserName> from other domains

Submitted by:  None
Submitted on:  Tue 22 Feb 2005 06:06:14 PM UTC  
 
Category: mainSeverity: 3 - Normal
Priority: 5 - NormalItem Group: normal bugs
Status: Works For MePrivacy: Public
Assigned to: Lukasz Marciniak <landm>Originator Name: Vit
Originator Email: -unavailable-Open/Closed: Closed
Release: 0.5.4Operating System: None
Reproducibility: Every TimePlanned Release: 0.5.5
Cyrus IMAP version: 2.2.xPHP version: 4.3
Database type: PostgreSQL 7.4

Add a New Comment(Rich Markup)
   

You are not logged in

Please log in, so followups can be emailed to you.

 

Fri 11 Aug 2006 12:42:11 PM UTC, comment #3:

If you want to use Cyrus with Virtual Domains you should have usernames (accounts) like -unavailable- in domain1.com and -unavailable- in domain2.com not name in domain1.com and name in domain2.com.

Lukasz Marciniak <landm>
Project MemberIn charge of this item.
Mon 31 Jul 2006 06:30:13 AM UTC, comment #2:

In standard configuration you can't create two accounts with the same name 'help'. And then the problem doesn't exists. Am i wrong?

Lukasz Marciniak <landm>
Project MemberIn charge of this item.
Sat 17 Dec 2005 02:03:08 PM UTC, comment #1:

it seems this has been fixed in 0.5.5-beta1 by useing following line:

$query = "UPDATE accountuser SET password='$new_password' where username='".$_POST['username']."'";

Roman Hochuli <medea61>
Tue 22 Feb 2005 06:06:14 PM UTC, original submission:

Suppose we have Cyrus-mail-users named equally, let's say,'help' in different domains, each such a user having it's own password:
(Cyrus with Virtual Domains)

>select user_name ||'@'|| domain_name as full_name, password from users_table where user_name='help';


full_name | password
---------------------------+-----------
-unavailable- | god
-unavailable- | love
-unavailable- | secret

Next, we change the password through the Web-Cyradm for help@domainA.org, with new password ='123pw456'.

Checking:

>select user_name ||'@'|| domain_name as full_name, password from users_table where user_name='help';


full_name | password
---------------------------+-----------
-unavailable- | 123pw456
-unavailable- | 123pw456
-unavailable- | 123pw456

Looking through sources I found the SQL statement used to change the passwords:

somewhere around line 16 in change_password.php:
$query = "select * from virtual where alias='$alias'";
....
$alias = $row['alias'];
....
line 46 of change_password.php:
$query = "update user_table set password='$new_password' where user_name='$username'";

So here it is - selecting user to change his password is done only by per username. Perhaps changing the logic to something like this must solve the problem:

$query = "update user_table set password='$new_password' where (user_name ||'@'|| domain_name) ='$alias'";

I mean that selecting the users for changing passwords can be done using not only username, but also his domain_name.
I've created a patch to have such a logic and it seem to work fine.

It could be a config option.

Cheers

Anonymous

 

(Note: upload size limit is set to 16384 kB, after insertion of the required escape characters.)

Attach File(s):
   
   
Comment:
   

Attached Files
file #2607:  change_password.php.diff added by None (718B - application/octet-stream - Quick-And-Dirty-Hack Patch)

 

Depends on the following items: None found

Items that depend on this one: None found

 

CC list is empty

 

Do you think this task is very important?
If so, you can click here to add your encouragement to it.
This task has 0 encouragements so far.

Only logged-in users can vote.

 

Please enter the title of George Orwell's famous dystopian book (it's a date):

 

 

Follow 8 latest changes.

Date Changed By Updated Field Previous Value => Replaced By
Fri 11 Aug 2006 12:42:11 PM UTClandmCategorysql=>main
  Item Groupsecurity=>normal bugs
  Assigned toNone=>landm
  Open/ClosedOpen=>Closed
  Planned ReleaseNone=>0.5.5
Mon 31 Jul 2006 06:30:13 AM UTClandmStatusNone=>Works For Me
Tue 22 Feb 2005 06:06:14 PM UTCNoneAttached File-=>Added change_password.php.diff, #2229
  Carbon-Copy-=>Added vetal --AT-- sacura --DOT-- net

Back to the top


Powered by Savane 3.1-cleanup1