Bug #76

A password of "test<space>" is not validated

Details

Submitted	2003-10-07 13:40 UTC
From	php at untz dot cx
Assigned	yavo
Status	Closed
Package	Auth
PHP Version	4.3.2
OS	win2k
Roadmaps	(Not assigned)

Comments

[2003-10-07 13:40 UTC] php at untz dot cx

Description:
------------
Due to $password being trim()'d before being validated, a password that begins or ends in a space (or any whitespace) is not validated correctly.

The second trim is alright if using MD5() crypting, but will cause problems if using no crypting. ie $password1 == $password2

Reproduce code:
---------------
http://cvs.php.net/annotate.php/pear/Auth/Container/DB.php?rev=1.38

Line 256 of DB.php and similar in MDB.php

if ($this->verifyPassword(trim($password),
trim($res[$this->options['passwordcol']]),
$this->options['cryptType'])) {

Expected result:
----------------
The user should be authenticated.
Should be validating MD5('test ') not MD5('test')

[2003-10-13 08:10 UTC] yavo at php dot net

This bug has been fixed in CVS.

In case this was a documentation problem, the fix will show up at the
end of next Sunday (CET) on pear.php.net.

In case this was a pear.php.net website problem, the change will show
up on the website in short time.

Thank you for the report, and for helping us make PEAR better.

Fixed bugs in DB and MDB container
changed trim($password) to trim($password, "\r\n")
to trim only new line and carriage return chars, am not sure if trim is really needed there thou.

Yavo