[patch] Case sensitive Authentication, but Case in-sensitive Authorization.
|Reported by:||Owned by:||Steffen Hoffmann|
|Cc:||trac-hacks@…, Felix, Mitar||Trac Release:||0.11|
I recently had an issue with my trac install and one of my programers. I am useing the following plugins:
- WebAdmin (from the trac website)
- TracAccountManager? (from trac-hacks)
My new programmer complained that he did not have the adequate permissions that he should have, so I created a test account named "test", and added it to the same permission-groups as that programmers account. All the permissions were set properly, the problem came from the fact that his account name contained uppercase letters. Creating an account called "TEST" and not enabling any permissions, gave me all the permissions assigned to the acount "test". To the login system "TEST" and "test" are completely different, however to the authorization (permission) system "TEST" and "test" are the exact same accounts, and furthermore will only apply the permissions set to the account "test" to both accounts when logged in.
This is a pretty big security hole in the AccountManagerPlugin System, as anyone can register an account using any combination of uppercase letters for any of your users or even permission groups.
This is pretty severe, I don't wish to have to add permissions for every combination of my admin accounts just to prevent anyone from hacking into my trac.
Change History (26)
comment:15 Changed 9 years ago by
|Owner:||changed from Matt Good to John Hampton|
|Status:||reopened → new|
comment:19 Changed 6 years ago by
|Keywords:||needinfo auth permission added|
|Owner:||changed from John Hampton to Steffen Hoffmann|
|Summary:||Case sensitive Authentication, and Case in-sensitive Authorization. → Case sensitive Authentication, but Case in-sensitive Authorization.|
comment:20 Changed 6 years ago by
|Priority:||highest → high|
|Severity:||blocker → critical|
|Status:||new → assigned|
|Summary:||Case sensitive Authentication, but Case in-sensitive Authorization. → [patch] Case sensitive Authentication, but Case in-sensitive Authorization.|