Bug 519050 - Luci does not validate passwords and incorrect characters can be used
Summary: Luci does not validate passwords and incorrect characters can be used
Alias: None
Product: Red Hat Enterprise Linux 5
Classification: Red Hat
Component: conga
Version: 5.5
Hardware: All
OS: Linux
Target Milestone: rc
: ---
Assignee: Ryan McCabe
QA Contact: Cluster QE
Depends On:
Blocks: 499522
TreeView+ depends on / blocked
Reported: 2009-08-24 18:05 UTC by Shane Bradley
Modified: 2018-10-27 15:51 UTC (History)
5 users (show)

Fixed In Version:
Doc Type: Bug Fix
Doc Text:
Clone Of:
Last Closed: 2010-03-30 08:55:34 UTC
Target Upstream Version:

Attachments (Terms of Use)
Patch for luci validation in "add user" (589 bytes, patch)
2009-08-24 18:06 UTC, Shane Bradley
no flags Details | Diff
luci_admin patch for admin user creation (447 bytes, patch)
2009-08-24 18:06 UTC, Shane Bradley
no flags Details | Diff

System ID Private Priority Status Summary Last Updated
Red Hat Product Errata RHBA-2010:0289 0 normal SHIPPED_LIVE conga bug fix and enhancement update 2010-03-29 15:04:29 UTC

Description Shane Bradley 2009-08-24 18:05:06 UTC
Description of problem:

Luci does not validate that validate characters are used for the
password. If someone uses " " or ":" then login will fail for that

Luci will not parse correctly the characters: " ", ":"

When a user is adding new user of the admin password then luci should
error if the characters are present: " ", ":"

Version-Release number of selected component (if applicable):

How reproducible:

Steps to Reproduce:
1. Add a user   
2. Give user a password with " " or ":"
3. Then try to login as that user
Actual results:

Login will fail.

Expected results:

The password should not be accepted and error given to user as to why.

Additional info:

Patches that should fix the issue will be attached.

Comment 1 Shane Bradley 2009-08-24 18:06:16 UTC
Created attachment 358495 [details]
Patch for luci validation in "add user"

Comment 2 Shane Bradley 2009-08-24 18:06:42 UTC
Created attachment 358496 [details]
luci_admin patch for admin user creation

Comment 5 Chris Ward 2010-02-11 10:09:29 UTC
~~ Attention Customers and Partners - RHEL 5.5 Beta is now available on RHN ~~

RHEL 5.5 Beta has been released! There should be a fix present in this 
release that addresses your request. Please test and report back results 
here, by March 3rd 2010 (2010-03-03) or sooner.

Upon successful verification of this request, post your results and update 
the Verified field in Bugzilla with the appropriate value.

If you encounter any issues while testing, please describe them and set 
this bug into NEED_INFO. If you encounter new defects or have additional 
patch(es) to request for inclusion, please clone this bug per each request
and escalate through your support representative.

Comment 7 Brian Brock 2010-03-11 02:06:54 UTC
fix verified in luci-0.12.2-12.el5

a descriptive error message is shown after trying to add a user with password containing spaces or colons

Comment 9 Shane Bradley 2010-03-19 17:27:39 UTC
Customer verified fixed issue.

Comment 10 errata-xmlrpc 2010-03-30 08:55:34 UTC
An advisory has been issued which should help the problem
described in this bug report. This report is therefore being
closed with a resolution of ERRATA. For more information
on therefore solution and/or where to find the updated files,
please follow the link below. You may reopen this bug report
if the solution does not work for you.


Note You need to log in before you can comment on or make changes to this bug.