0010979: New user creation when using LDAP authentication enters plain text password user entered into the database.

ID	Project	Category	View Status	Date Submitted	Last Update
0010979	mantisbt	ldap	public	2009-09-22 18:42	2010-02-22 14:34

Reporter	brianstv	Assigned To	vboctor
Priority	normal	Severity	minor	Reproducibility	always
Status	closed	Resolution	fixed
Product Version	git trunk
Target Version	1.2.0	Fixed in Version	1.2.0

Summary	0010979: New user creation when using LDAP authentication enters plain text password user entered into the database.
Description	On system using LDAP authentication and a new user logs into mantis, they are authenticated via LDAP, but the 'user_create' function stores their password in the database in plain text. Setting the password to '' would be preferable as that field is not used for authentication anyway when 'login_method' is set to LDAP. This function would also be a good place to set the User's realname from the values in LDAP for historical purposes if 'use_ldap_realname' is set to ON. See 0010910 for a related problem.
Tags	No tags attached.

MantisBT: master 81660f13 2009-10-14 00:48 vboctor Details Diff	Fix 0010979: New user creation when using LDAP authentication enters plain text password user entered into the database.	Affected Issues 0010979
	mod - core/authentication_api.php	Diff File
MantisBT: master-1.2.x 096c46d1 2009-10-14 00:48 vboctor Details Diff	Fix 0010979: New user creation when using LDAP authentication enters plain text password user entered into the database.	Affected Issues 0010979
	mod - core/authentication_api.php	Diff File

vboctor 2009-10-14 00:52 manager ~0023170	The MD5 password is now saved. This will allow login from the database if MantisBT login switches back to native MD5 login. In the future, we can also default to DB passwords if LDAP is down.