PacketFence - BTS - PacketFence
View Issue Details
IDProjectCategoryView StatusDate SubmittedLast Update
0001209PacketFenceweb adminpublic2011-04-15 09:442011-10-25 09:01
Reporterobilodeau 
Assigned Toobilodeau 
PrioritynormalSeverityminorReproducibilityrandom
StatusclosedResolutionfixed 
PlatformOSOS Version
Product Version 
Target Version2.2.0Fixed in Version2.2.0 
fixed in git revision
fixed in mtn revision61d19ed0e299247522c5a47138a25445bcdc7ac1
Summary0001209: problematic password validation
DescriptionPassword validation on the Web UI is sketchy.

There's an arbitrary length and a regexp validation on the first character that seems unnecessary for a password field never intended to be displayed (no XSS).

Passwords like !12345 currently fails.

Get rid of the validation.
Steps To Reproduce
Additional Information
TagsNo tags attached.
Relationships
related to 0001293closed obilodeau Issues with LDAP-based authentication in web administration interface (login.php) 
Attached Files
Issue History
Date ModifiedUsernameFieldChange
2011-04-15 09:44obilodeauNew Issue
2011-04-15 09:44obilodeauStatusnew => assigned
2011-04-15 09:44obilodeauAssigned To => obilodeau
2011-04-15 09:44obilodeauNote Added: 0002028
2011-04-15 09:55obilodeaumtn revision => 61d19ed0e299247522c5a47138a25445bcdc7ac1
2011-04-15 09:55obilodeauStatusassigned => resolved
2011-04-15 09:55obilodeauFixed in Version => +1
2011-04-15 09:55obilodeauResolutionopen => fixed
2011-05-04 11:32obilodeauFixed in Version+1 => 2.2.0
2011-05-04 11:40obilodeauStatusresolved => closed
2011-10-12 15:07obilodeauRelationship addedrelated to 0001293
2011-10-25 09:01obilodeauTarget Version+1 => 2.2.0

Notes
(0002028)
obilodeau   
2011-04-15 09:44   
Turns out passwords should be validated at least against nulls since ldap_bind with a null value does an anonymous bind.