[dokuwiki] Re: Mixed / chained authentication (LDAP + plain)
- From: DennisV <dennisv.ut@xxxxxxxxx>
- To: dokuwiki@xxxxxxxxxxxxx
- Date: Tue, 13 Mar 2007 14:05:47 +0100
I changed the code on the wiki to make it PHP4 compatible. PHP4
doesn't seem to like:
$this->getAuthFromUser($user)->modifyUser($user,$changes);
You'll need to do it in 2 steps.
I found another issue with chained authentication when using "plain"
as one of the authenticators.
"plain" does the following "clean-up" during initialization:
--------------------------------------------------------
// we only accept page ids for auth_plain
if(isset($_REQUEST['u']))
$_REQUEST['u'] = cleanID($_REQUEST['u']);
if(isset($_REQUEST['acl_user']))
$_REQUEST['acl_user'] = cleanID($_REQUEST['acl_user']);
// the same goes for password reset requests
if(isset($_POST['login'])){
$_POST['login'] = cleanID($_POST['login']);
}
--------------------------------------------------------
Since it directly changes request items, it also influences other
authenticators. Wouldn't it be wiser to use a reversible mapping for
"plain" to store user and group names? The ACL plugin already uses
auth_nameencode(), isn't this sufficient already?
Regards,
Dennis
--
DokuWiki mailing list - more info at
http://wiki.splitbrain.org/wiki:mailinglist
Other related posts:
