Edit report at http://pear.php.net/bugs/bug.php?id=18420&edit=1
ID: 18420
Updated by: [email protected]
Reported By: chealer at gmail dot com
Summary: connect() option bindpw is not necessarily a password
-Status: Verified
+Status: Closed
Type: Documentation Problem
Package: Net_LDAP2
Package Version: 2.0.11
PHP Version: 5.3.6
Assigned To: beni
Roadmap Versions:
New Comment:
-Status: Verified
+Status: Closed
This bug has been fixed in SVN.
If this was a documentation problem, the fix will appear on pear.php.net
by the end of next Sunday (CET).
If this was a problem with the pear.php.net website, the change should
be live shortly.
Otherwise, the fix will appear in the package's next release.
Thank you for the report and for helping us make PEAR better.
Previous Comments:
------------------------------------------------------------------------
[2011-04-04 06:33:13] beni
-Status: Open
+Status: Verified
-Assigned To:
+Assigned To: beni
Hello, you are right. This definitely needs enhanced documentation.
------------------------------------------------------------------------
[2011-04-02 23:35:41] chealer
Description:
------------
The description of the bindpw option for connect() is inexact. It
reads:
Password for the binddn
In fact bindpw can also be the empty string if one wants to request
unauthenticated (or anonymous) authentication.
This is more than an undocumented feature. By taking an empty bindpw and
sending it raw to an LDAP server, Net_LDAP2 is requesting
unauthenticated authentification, which is not what one would expect
from the current documentation. This can cause critical security issues.
See http://tools.ietf.org/html/rfc4513#section-6.3.1 on this issue.
------------------------------------------------------------------------
--
Edit this bug report at http://pear.php.net/bugs/bug.php?id=18420&edit=1
lmpx.com only provides a reader for public news (NNTP) servers. It is not
affiliated with the servers or forums shown here and is not responsible for
the content of articles, which is written by their respective authors.