{"action":"created","issue":{"url":"https://api.github.com/repos/nilsteampassnet/TeamPass/issues/1530","repository_url":"https://api.github.com/repos/nilsteampassnet/TeamPass","labels_url":"https://api.github.com/repos/nilsteampassnet/TeamPass/issues/1530/labels{/name}","comments_url":"https://api.github.com/repos/nilsteampassnet/TeamPass/issues/1530/comments","events_url":"https://api.github.com/repos/nilsteampassnet/TeamPass/issues/1530/events","html_url":"https://github.com/nilsteampassnet/TeamPass/issues/1530","id":180886740,"number":1530,"title":"Logging in with an AD-user that has no corresponding user in the TeamPass database reveals ALL passwords for a limited period.","user":{"login":"mflage","id":837316,"avatar_url":"https://avatars0.githubusercontent.com/u/837316?v=3","gravatar_id":"","url":"https://api.github.com/users/mflage","html_url":"https://github.com/mflage","followers_url":"https://api.github.com/users/mflage/followers","following_url":"https://api.github.com/users/mflage/following{/other_user}","gists_url":"https://api.github.com/users/mflage/gists{/gist_id}","starred_url":"https://api.github.com/users/mflage/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/mflage/subscriptions","organizations_url":"https://api.github.com/users/mflage/orgs","repos_url":"https://api.github.com/users/mflage/repos","events_url":"https://api.github.com/users/mflage/events{/privacy}","received_events_url":"https://api.github.com/users/mflage/received_events","type":"User","site_admin":false},"labels":[],"state":"open","locked":false,"assignee":null,"assignees":[],"milestone":null,"comments":4,"created_at":"2016-10-04T13:02:15Z","updated_at":"2017-07-08T07:33:16Z","closed_at":null,"body":"<!--\nThanks for reporting issues back to Teampass! This is the issue tracker of Teampass, if you have any support question please check out https://groups.google.com/forum/?hl=fr#!forum/theteampass\n\nTo make it possible for us to help you please fill out below information carefully.\n--> \n### Steps to reproduce\n1. Battle with LDAP integration setup (a hassle in itself to get working)\n2. Log in with a user that doesn't exist in the local TeamPass database\n3. View all passwords\n### Expected behaviour\n\nThe user shouldn't be allowed to log in at all, as it has no corresponding entry in the local TeamPass database.\n### Actual behaviour\n\nInstead the user can view ALL passwords.\n### Server configuration\n\n**Operating system**:\nDebian Jessie 8.5\n\n**Web server:**\nApache 2.4.10\n\n**Database:**\nMariaDB 5.5.47\n\n**PHP version:**\n5.6.22-0\n\n**Teampass version:** \n2.1.23\n\n**Updated from an older Teampass or fresh install:**\nUpdated from older TeamPass version.\n### Client configuration\n\n**Browser:**\nDifferent\n\n**Operating system:**\nGenerally Microsoft Windows\n### Logs\n#### Web server error log\n\n```\nInsert your webserver log here\n```\n#### Firebug log ([How to?](http://teampass.net/2014-02-09-how-to-communicate-an-error-log))\n\n```\nInsert the Firebug log here\n```\n"},"comment":{"url":"https://api.github.com/repos/nilsteampassnet/TeamPass/issues/comments/313840557","html_url":"https://github.com/nilsteampassnet/TeamPass/issues/1530#issuecomment-313840557","issue_url":"https://api.github.com/repos/nilsteampassnet/TeamPass/issues/1530","id":313840557,"user":{"login":"mflage","id":837316,"avatar_url":"https://avatars0.githubusercontent.com/u/837316?v=3","gravatar_id":"","url":"https://api.github.com/users/mflage","html_url":"https://github.com/mflage","followers_url":"https://api.github.com/users/mflage/followers","following_url":"https://api.github.com/users/mflage/following{/other_user}","gists_url":"https://api.github.com/users/mflage/gists{/gist_id}","starred_url":"https://api.github.com/users/mflage/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/mflage/subscriptions","organizations_url":"https://api.github.com/users/mflage/orgs","repos_url":"https://api.github.com/users/mflage/repos","events_url":"https://api.github.com/users/mflage/events{/privacy}","received_events_url":"https://api.github.com/users/mflage/received_events","type":"User","site_admin":false},"created_at":"2017-07-08T07:33:15Z","updated_at":"2017-07-08T07:33:15Z","body":"I wish I could, but all my efforts to upgrade this product as thus far\nfailed horribly, so I'm still running 2.1.24.\n\n--\nMarius\n\nDen 22.06.2017 20.00, skrev Nils Laumaillé:\n>\n> As I cannot test, can you please do the next change assuming you are\n> using 2.1.27\n>\n> Open file |sources/identify.php|, around line 545 found\n>\n> |DB::insert( prefix_table('users'), array( 'login' => $username, 'pw'\n> => $data['pw'], 'email' => @$user_info_from_ad[0]['mail'][0], 'name'\n> => $user_info_from_ad[0]['givenname'][0], 'lastname' =>\n> $user_info_from_ad[0]['sn'][0], 'admin' => '0', 'gestionnaire' => '0',\n> 'can_manage_all_users' => '0', 'personal_folder' =>\n> $_SESSION['settings']['enable_pf_feature'] == \"1\" ? '1' : '0',\n> 'fonction_id' => '0', 'groupes_interdits' => '0', 'groupes_visibles'\n> => '0', 'last_pw_change' => time(), 'user_language' =>\n> $_SESSION['settings']['default_language'] ) ); |\n>\n> and replace by\n>\n> |DB::insert( prefix_table('users'), array( 'login' => $username, 'pw'\n> => $data['pw'], 'email' => @$user_info_from_ad[0]['mail'][0], 'name'\n> => $user_info_from_ad[0]['givenname'][0], 'lastname' =>\n> $user_info_from_ad[0]['sn'][0], 'admin' => '0', 'gestionnaire' => '0',\n> 'can_manage_all_users' => '0', 'personal_folder' =>\n> $_SESSION['settings']['enable_pf_feature'] == \"1\" ? '1' : '0',\n> 'fonction_id' => '', 'groupes_interdits' => '', 'groupes_visibles' =>\n> '', 'last_pw_change' => time(), 'user_language' =>\n> $_SESSION['settings']['default_language'], 'encrypted_psk' => '' ) ); |\n>\n> Note if you are in *2.1.26*, then remove the last entry\n> |'encrypted_psk' => ''|\n>\n> —\n> You are receiving this because you authored the thread.\n> Reply to this email directly, view it on GitHub\n> <https://github.com/nilsteampassnet/TeamPass/issues/1530#issuecomment-310456407>,\n> or mute the thread\n> <https://github.com/notifications/unsubscribe-auth/AAzGxBl0IW3ypyGoryJwdf1_Xv5VaWu2ks5sGqvCgaJpZM4KNpgx>.\n>\n\n"}}
{"actor":{"display_login":"mflage"}}