Red Hat Bugzilla – Bug 1268624
Corner case where lxdm allows the login even if the provided password is wrong
Last modified: 2015-10-13 15:51:45 EDT
Description of problem:
I found what seems a corner case where lxdm allows the login even if the provided password is wrong. This might not be a true bug, but in my opinion the behavior of lxdm in this situation is somehow strange.
Version-Release number of selected component (if applicable):
Steps to Reproduce:
1. Create an user without password.
2. Login through lxdm with that user.
3. Provide a password for the login.
lxdm allows the user to login.
In my opinion (but I might be wrong), lxdm should refuse the login. The real password is blank, so if no blank password is provided, the real combination of "login name + password" is not actually matched.
Fedora 23 Final TC1 (x86_64) on qemu-kvm.
*** This bug has been marked as a duplicate of bug 1271377 ***