[interchange] Turn off UserDB ignore_case
Josh Lavin <[email protected]> Mon, 31 Oct 2016 21:20:43 +0000
| Newsgroups | gmane.comp.web.interchange.cvs |
|---|---|
| Message-ID | <[email protected]> |
commit de456880f8ec7a60d28e4b01e667334a4cbc632e Author: Josh Lavin <[email protected]> Date: Mon Oct 31 14:17:37 2016 -0700 Turn off UserDB ignore_case - As this stores username/password in lowercase, it is not great for security. Also it has the effect of preventing password changes once you toggle it. - If there were an option to standardize the case of usernames on login, that would be nice. But affecting passwords as well is not what we want here. dist/strap/catalog.cfg | 3 +-- 1 files changed, 1 insertions(+), 2 deletions(-) --- diff --git a/dist/strap/catalog.cfg b/dist/strap/catalog.cfg index 693891a..1e10caa 100644 --- a/dist/strap/catalog.cfg +++ b/dist/strap/catalog.cfg @@ -270,7 +270,7 @@ UserDB default from_plain 1 UserDB default bcrypt_pepper __BCRYPT_PEPPER__ # Set to 1 to make the username and password case-insensitive -UserDB default ignore_case 1 +UserDB default ignore_case 0 # Change a field to something that doesn't conflict in MySQL UserDB default time_field mod_time @@ -304,7 +304,6 @@ EOU UserDB default logfile logs/userdb.log # This makes the login username the user's email address -# Uncomment to use UserDB default indirect_login usernick UserDB default assign_username 1