#76 [NEW]: A password of "test<space>" is not validated
| From: | php at untz dot cx | Date: | Tue, 07 Oct 2003 13:40:57 +0000 |
| Subject: | #76 [NEW]: A password of "test<space>" is not validated | ||
| Groups: | php.pear.dev | ||
| Request: | Send a blank email to pear-dev+get-22445@lists.php.net to get a copy of this message | ||
From: php at untz dot cx
Operating system: win2k
PHP version: 4.3.2
PHP Bug Type: Auth
Bug description: A password of "test<space>" is not validated
Description:
------------
Due to $password being trim()'d before being validated, a password that
begins or ends in a space (or any whitespace) is not validated correctly.
The second trim is alright if using MD5() crypting, but will cause
problems if using no crypting. ie $password1 == $password2
Reproduce code:
---------------
http://cvs.php.net/annotate.php/pear/Auth/Container/DB.php?rev=1.38
Line 256 of DB.php and similar in MDB.php
if ($this->verifyPassword(trim($password),
trim($res[$this->options['passwordcol']]),
$this->options['cryptType'])) {
Expected result:
----------------
The user should be authenticated.
Should be validating MD5('test ') not MD5('test')
--
Edit bug report at http://pear.php.net/bugs/bug.php?id=76&edit=1
--