FreeLists / dokuwiki / [dokuwiki] Re: Mixed / chained authentication (LDAP + plain)

[DennisV <dennisv.ut@xxxxxxxxx>]

I changed the code on the wiki to make it PHP4 compatible. PHP4
doesn't seem to like:
$this->getAuthFromUser($user)->modifyUser($user,$changes);
You'll need to do it in 2 steps.

I found another issue with chained authentication when using "plain"
as one of the authenticators.

"plain" does the following "clean-up" during initialization:
--------------------------------------------------------
// we only accept page ids for auth_plain
if(isset($_REQUEST['u']))
 $_REQUEST['u'] = cleanID($_REQUEST['u']);
if(isset($_REQUEST['acl_user']))
 $_REQUEST['acl_user'] = cleanID($_REQUEST['acl_user']);
// the same goes for password reset requests
if(isset($_POST['login'])){
 $_POST['login'] = cleanID($_POST['login']);
}
--------------------------------------------------------
Since it directly changes request items, it also influences other
authenticators. Wouldn't it be wiser to use a reversible mapping for
"plain" to store user and group names? The ACL plugin already uses
auth_nameencode(), isn't this sufficient already?

Regards,
Dennis
--
DokuWiki mailing list - more info at
http://wiki.splitbrain.org/wiki:mailinglist