Skip to content

Commit

Permalink
FIX: _SESSION['password'] was superseded by EncryptionStore
Browse files Browse the repository at this point in the history
  • Loading branch information
@qyanu @silentsakky
qyanu authored and silentsakky committed Apr 18, 2017
1 parent dd305cc commit 3cafedc
Showing 1 changed file with 12 additions and 1 deletion.
13 changes: 12 additions & 1 deletion php/class.passwdmodule.php
View file
Original file line number Diff line number Diff line change
Expand Up @@ -201,8 +201,19 @@ public function saveInDB($data)

// get current session password
$sessionPass = $_SESSION['password'];
// if this plugin is used on a webapp version with EncryptionStore,
// $_SESSION['password'] is no longer available. User EncryptionStore
// in this case.
// EncryptionStore was introduced in webapp core somewhere after
// version 2.1.2, and with or before version 2.2.0.414.
// tested with Zarafa WebApp 2.2.1.43-199.1 running with
// Zarafa Server 7.2.4.29-99.1
if(class_exists("EncryptionStore")) {
$encryptionStore = EncryptionStore::getInstance();
$sessionPass = $encryptionStore->get("password");
}
// if user has openssl module installed
if (function_exists("openssl_decrypt")) {
else if (function_exists("openssl_decrypt")) {
if (version_compare(phpversion(), "5.3.3", "<")) {
$sessionPass = openssl_decrypt($sessionPass, "des-ede3-cbc", PASSWORD_KEY, 0);
} else {
Expand Down

2 comments on commit 3cafedc

@linnea-s
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

It would be nice to also handle writing the new password to EncryptionStore, so that users don't have to log in again after changing their password. Have you tried to do this? I tried replacing the OpenSSL code in saveInLDAP with basically:

$encryptionStore = EncryptionStore::getInstance();
$encryptionStore->add('password', $passwd);

But it doesn't appear to work.

@silentsakky
Copy link
Owner

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Fixed in a954946

Please sign in to comment.