Bug & solution in password plugin

[levente.csabai]

The bug:

In /plugins/password/config.inc.php the comment says:

//      %d is replaced with the domain part of the username
//         (in case the username is an email address)

If I create a query (for Postfix):

$rcmail_config['password_query'] = 'UPDATE mailbox SET password=%p WHERE username=%u AND password=%o AND domain=%d LIMIT 1';

the domain will be the username's local part:

UPDATE mailbox SET password=asdasd WHERE username=user@domain.com AND password=qweqwe AND domain=user LIMIT 1

The solution:

In /plugins/password/drivers/sql.php replace this line (line 84):

$sql = str_replace('%d', $db->quote($user_info[0], 'text'), $sql);

to this:

$sql = str_replace('%d', $db->quote($user_info[1], 'text'), $sql);

because the second part of the username (after the @) is the domain part.

[netbit]

This bug was fixed some days ago in [3dd90d32]. Please update your RC to latest version from trunk (​http://trac.roundcube.net/changeset/latest/trunk/?old_path=%2F&format=zip).

Thank you.