anzenehansen/blesta-goodies

Various stuff for Blesta (plugins, helper scripts, etc...)

blesta-goodies's Issues

huge authentication flaw

1 - Success, but continue processing MySQL tables as well
2 - Success, don't bother checking MySQL tables

Hi,

I installed this and noticed two huge flaws.

1. Your password in the MySQL table must be identical to the ldap user password. If not, it will return as an error because the username and password don't match.
2. I found that since it doesn't check the MySQL table, you don't even have to enter a password. I literally entered a username and hit enter and was allowed in the admin section. It simply ignores all passwords.

This should authenticate through Ldap username and password without having to be identical to the Mysql table (it defeats the purpose and will be a nightmare when you change your ldap password) It should also not ignore the need to enter the correct ldap password as in #2.

Hope this helps.