Thanks to visit codestin.com
Credit goes to github.com

Skip to content

[Ldap] cast to string when checking empty passwords #26589

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom
Closed
wants to merge 3 commits into from
Closed

[Ldap] cast to string when checking empty passwords #26589

wants to merge 3 commits into from

Conversation

ismail1432
Copy link
Contributor

Q A
Branch? master for features / 2.7 up to 4.0 for bug fixes
Bug fix? yes
New feature? no
BC breaks? no
Deprecations? no
Tests pass? yes
Fixed tickets #26525
License MIT
Doc PR symfony/symfony-docs#...

@ismail1432 ismail1432 mentioned this pull request Mar 18, 2018
Closed
fabpot
fabpot requested changes Mar 18, 2018
View reviewed changes
src/Symfony/Component/Security/Core/Authentication/Provider/LdapBindAuthenticationProvider.php Outdated
@@ -84,7 +84,7 @@ protected function checkAuthentication(UserInterface $user, UsernamePasswordToke
$username = $token->getUsername();
$password = $token->getCredentials();

if ('' === $password) {
if (empty($password)) {
Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

We try to avoid using empty in Symfony. Here, a password like 0 would return true with empty, which is not what we want here.

Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Thanks for feedback, What about use the NotBlankValidator condition if(empty($value) && '0' != $value)

Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I'd suggest to write this as if ('' === (string) $password) {

Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Thanks @nicolas-grekas I applied your code in the PR, Hope it's good

nicolas-grekas
nicolas-grekas requested changes Mar 19, 2018
View reviewed changes
Copy link
Member

@nicolas-grekas nicolas-grekas left a comment •
edited
Loading

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

(to be merged on 2.8)

src/Symfony/Component/Security/Core/Authentication/Provider/LdapBindAuthenticationProvider.php Outdated
@@ -84,7 +84,7 @@ protected function checkAuthentication(UserInterface $user, UsernamePasswordToke
$username = $token->getUsername();
$password = $token->getCredentials();

if ('' === $password) {
if (empty($password)) {
Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I'd suggest to write this as if ('' === (string) $password) {

@nicolas-grekas nicolas-grekas changed the title change condition on checkAuthentication [Ldap] change condition on checkAuthentication Mar 19, 2018
@nicolas-grekas nicolas-grekas changed the title [Ldap] change condition on checkAuthentication [Ldap] cast to string when checking empty passwords Mar 19, 2018
@nicolas-grekas nicolas-grekas added this to the 2.8 milestone Mar 19, 2018
@ismail1432
Correct PR after reviews
fdb1362 
I updated the source code following your advices and applied Nicolas code
nicolas-grekas
nicolas-grekas approved these changes Mar 19, 2018
View reviewed changes
Copy link
Member

@nicolas-grekas nicolas-grekas left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

(for 2.8)

@nicolas-grekas
Copy link
Member

@ismail1432 would you mind adding a test case please?

@ismail1432
Copy link
Contributor Author

@nicolas-grekas sorry for answer now, this test is not enough ? To be honest I don't have enough experience in Security and Tests to go more far... Sorry.

@nicolas-grekas
Copy link
Member

I mean a test case, something in https://github.com/symfony/symfony/blob/master/src/Symfony/Component/Security/Core/Tests/Authentication/Provider/LdapBindAuthenticationProviderTest.php
that would ensure that passing a null password works.

@ismail1432
Copy link
Contributor Author

thanks for feedback, I add test with null password and it works

@nicolas-grekas
Copy link
Member

Thank you @ismail1432.

nicolas-grekas added a commit that referenced this pull request Mar 22, 2018
@nicolas-grekas
bug #26589 [Ldap] cast to string when checking empty passwords (ismai…
2f5bd18 
…l1432)

This PR was submitted for the master branch but it was squashed and merged into the 2.8 branch instead (closes #26589).

Discussion
----------

[Ldap] cast to string when checking empty passwords

| Q             | A
| ------------- | ---
| Branch?       | master for features / 2.7 up to 4.0 for bug fixes <!-- see below -->
| Bug fix?      | yes
| New feature?  | no <!-- don't forget to update src/**/CHANGELOG.md files -->
| BC breaks?    | no     <!-- see https://symfony.com/bc -->
| Deprecations? | no <!-- don't forget to update UPGRADE-*.md files -->
| Tests pass?   | yes    <!-- please add some, will be required by reviewers -->
| Fixed tickets | #26525  <!-- #-prefixed issue number(s), if any -->
| License       | MIT
| Doc PR        | symfony/symfony-docs#... <!-- required for new features -->

<!--
Quick fix condition that solved the issue.
-->

Commits
-------

f276989 [Ldap] cast to string when checking empty passwords
This was referenced Apr 2, 2018
Merged
Merged
Merged
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Reviewers

@fabpot fabpot fabpot requested changes

@nicolas-grekas nicolas-grekas nicolas-grekas approved these changes

Assignees
No one assigned
Labels
Bug Status: Reviewed
Projects
None yet
Milestone
2.8
Development

Successfully merging this pull request may close these issues.
4 participants
@ismail1432 @nicolas-grekas @fabpot @carsonbot