Opened 7 years ago
Closed 7 years ago
#1468895 closed Bugs (fixed)
passwords with less than sign (<) don't work
| Reported by: | nobody | Owned by: | thomasb |
|---|---|---|---|
| Priority: | 5 | Milestone: | 0.1-beta2 |
| Component: | Other | Version: | None |
| Severity: | critical | Keywords: | |
| Cc: |
Description (last modified by thomasb)
After upgrading to roundcube-0.1-20060328.tar.bz2 (from
unixified.net) from the 0.1 beta, I can't log in using
a password that contains a less than sign (<).
If my password were "abc<def", roundcube thinks that my
password is "abc".
Change History (4)
comment:1 Changed 7 years ago by nobody
comment:2 Changed 7 years ago by nobody
Logged In: NO
Reverting this change seems to solve the problem.
@@ -144,7 +137,10 @@
{
show_message("cookiesdisabled", 'warning');
}
- else if (isset($_POST['_user']) && isset($_POST['_pass'])
&& rcmail_login($_POST['_user'], $_POST['_pass'], $host))
+ else if (isset($_POST['_user']) && isset($_POST['_pass']) &&
+ rcmail_login(get_input_value('_user',
RCUBE_INPUT_POST),
+ get_input_value('_pass',
RCUBE_INPUT_POST),
+ $host))
{
// send redirect
header("Location: $COMM_PATH");
comment:3 Changed 7 years ago by thomasb
- Description modified (diff)
- Owner changed from nobody to thomasb
- Status changed from assigned to new
- Summary changed from passwords with less than sign (<) don't work to passwords with less than sign (<) don't work
rcmail_login() uses strip_tags() for XSS protection which obviously strips that off.
comment:4 Changed 7 years ago by thomasb
- Resolution changed from None to fixed
- Status changed from new to closed
Fixed in Trunk
Note: See
TracTickets for help on using
tickets.
Logged In: NO Reverting this change seems to fix the problem. @@ -144,7 +137,10 @@ { show_message("cookiesdisabled", 'warning'); } - else if (isset($_POST['_user']) && isset($_POST['_pass']) && rcmail_login($_POST['_user'], $_POST['_pass'], $host)) + else if (isset($_POST['_user']) && isset($_POST['_pass']) && + rcmail_login(get_input_value('_user', RCUBE_INPUT_POST), + get_input_value('_pass', RCUBE_INPUT_POST), + $host)) { // send redirect header("Location: $COMM_PATH");