Re: New release is HERE! Vexim 2.2.2 RC1, Google code, and more!

Yes, I noticed exactly the same thing when working through that part of 
the code.  It even presented challenges for me successfully exploiting a 
line of potential attack vectors. 

At considered fixing the code to allow multiple accounts with a 
siteadmin localpart, but then decided to stick to my policy of purely 
security related fixes.  
One of the keys to consider if you feel like submitting a patch, is if a 
domain isn't specified, the code will need to default to using the 
existing true siteadmin account - as a number of siteadmin's for various 
vexim installations will be logging in as siteadmin without specifying 
"domain" as their domain.

Cheers,

- Mike

On 14/05/2010 2:45 p.m., Colin wrote:
> On Thu, May 13, 2010 at 1:24 PM, Avleen Vig 
> <[email protected] <mailto:[email protected]>> 
> wrote:
>
>     With a *HUGE* thank you to Mike Garrett and Gordon Dickens who did all
>     of the work for this release.
>
>
>     This is an RC release, hopefully the only one. If people could test it
>     and let me know if it works, that would be great :-)
>     I hope to have the stable release tomorrow or the day after.
>
>
> One thing I've noticed (and actually, this exists in the previous 
> version as well):
> You can't have [email protected] <mailto:[email protected]>.  
> The login page seems to assume that if the localpart is siteadmin, 
> then it must be the actual built-in user "siteadmin", as if I use the 
> password for the "super" siteadmin, even when specifying a domain, it 
> will login as the "super" site admin.
>
> If you have your "siteadmin" password as "supersecret"  and then you 
> create "[email protected] <mailto:[email protected]>" with the 
> password of "password" you have the following problems when logging in:
> username: "siteadmin", domain name: "domain.com <http://domain.com>", 
> password: "password" - error "login failed"
> username: "siteadmin", domain name: "domain.com <http://domain.com>", 
> password: "supersecret" - login success but as the "super" siteadmin.
>
> Not a huge deal, and I don't think it should postpone the release of 
> this security update, but something to think about.
> ------------------------------------------------------------------------
>
> _______________________________________________
> Vexim mailing list
> [email protected]
> http://silverwraith.com/mailman/listinfo/vexim