Bug 225163

Summary:	Able to register to webqa with valid username/any password
Product:	[Retired] Red Hat Network	Reporter:	Jay Turner <jturner>
Component:	RHN/Backend	Assignee:	Jesus M. Rodriguez <jesusr>
Status:	CLOSED CURRENTRELEASE	QA Contact:	Corey Welton <cwelton>
Severity:	high	Docs Contact:
Priority:	high
Version:	RHN Devel	CC:	duffy, rhn-bugs, srevivo
Target Milestone:	---
Target Release:	---
Hardware:	All
OS:	Linux
Whiteboard:
Fixed In Version:	5.0.0	Doc Type:	Bug Fix
Doc Text:		Story Points:	---
Clone Of:		Environment:
Last Closed:	2007-02-12 20:24:50 UTC	Type:	---
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:
Bug Depends On:
Bug Blocks:	166615

Description Jay Turner 2007-01-29 16:11:07 UTC

Description of problem:
With rhn-client-tools-0.4.8-1.el5.noarch going against webqa (as it sits at
11:00 on 29.1.2007) I'm able to register against webqa using a valid username
and any password I care to enter.

1) run rhn_register
2) at the Update Location screen, enter
"https://xmlrpc.rhn.webqa.redhat.com/XMLRPC" as the location and continue
3) enter a valid username and any password you like

Will work.

Really shouldn't work.

Comment 1 Jay Turner 2007-01-29 16:12:18 UTC

Proposing as RHEL5 blocker, as otherwise this code might make it to the live
site.  Need some sort of resolution prior to that.

Comment 2 Máirín Duffy 2007-01-29 22:25:35 UTC

may be related to bug 223515

Comment 3 Jesus M. Rodriguez 2007-02-02 02:23:13 UTC

TEST PLAN
-----------
1) ping xmlrpc.rhn.webqa.redhat.com
2) edit /etc/hosts with the following:
   <ip address from above ping> xmlrpc.rhn.redhat.com

   While this seems silly, it goes through the "hosted" code path which 
   is important to test versus the one mentioned in step 2 of original comment

3) Continue with Step 1 & 3 from Original Comment.

Comment 4 Corey Welton 2007-02-08 16:12:01 UTC

QA Verified -- can no longer login using an arbitrary password.

Comment 5 Jay Turner 2007-02-12 20:24:50 UTC

Closing out.