Ticket #325 (closed Bug report: fixed)

Opened 2 years ago

Last modified 8 months ago

Install.php doesn't validate initial wifidog password properly

Reported by: golden_rock@hotmail.com Assigned to: Robin Jones
Priority: low Milestone: WifiDog Auth Server 1.0
Component: Auth server, Authentication, permissions and access control Keywords:
Cc:

Description

The problem is simple: when I installed wifidog with install.php, I set a password with lots of special characters including *, &, ! and more. The installation allowed me to go on, and wifidog worked well.

But then came the time I tried to change the password, it wouldn't allow me because the client side validation wouldn't pass. The javascript isValidPassword() function fails because it matches the password to the regular expression /[0-9a-zA-Z]{6,}$/ which doesn't cover the special characters I input initially. Actually it forces the user to use only alphanumeric passwords... (in formutils.js)

I went over this bug by modifying the formutils.js file, making the isValidPassword() function return true all the times, change my password and then restore the old formutils.js file. It worked.

Wifidog shouldn't have let me use special characters initially if change_password.php doesn't allow them. And should change_password validate the old password field? Perhaps.

My wifidog auth server version dates from 2006-12-12. If the bug hasn't been discovered yet, then here's an occasion to fix it.

Thanks guys!

wad

Attachments

Change History

05/21/07 01:05:01 changed by golden_rock@hotmail.com

So in other words, install.php allows special characters, but change_password.php doesn't allow special characters AND change_password.php tries to validate the old password. So basically, i was stuck until I disable the client side validation.

06/23/07 14:27:13 changed by benoitg

Thanks for your very clear bug report. This indeed need's fixing.

01/06/08 18:58:09 changed by Robin Jones

A temporary fix to this has already been commited, although it needs to be changed so that the regular expression(s) are called from a central location either js/formutils.js or signup.php

01/22/08 09:38:38 changed by networkfusion

  • priority changed from normal to low.
  • owner set to Robin Jones.

04/01/08 23:08:30 changed by networkfusion

  • status changed from new to closed.
  • resolution set to fixed.

Fixed in [1343]

Add/Change #325 (Install.php doesn't validate initial wifidog password properly)




Action