RocketChat / RocketChat/Rocket.Chat
LDAP wrong password if containing dollar sign
Open
@pierre-lehnen-rc is already working on this.
Since Oct 1, 2019.
area: authentication
- Dominant language
- TypeScript
- Stars
- 46.1k
- Forks
- 13.9k
- Avg merge
- 3d 3h
- Merged PRs (30d)
- 130
Description
Description:
One of our user has a ldap password containing a $ in it. He has to use his password shorten to before the $ sign in order to be able to login.
Example password : blablabla$bliblibli
Working password : blablabla
Steps to reproduce:
- Create a user with a ldap password containing $ and some other caracters after
- Try to connect using the regular password
- That should fail until you type only the part before $
Expected behavior:
The whole password should be accepted.
Actual behavior:
Only the part before the $ sign is accepted to let the user login.
Server Setup Information:
- 1.3.2
- RHEL7
- docker
- 1
- DB Replicaset Oplog:
- NodeJS Version: v8.11.4
- MongoDB Version: 4.0.6
Additional context
NA
Relevant logs:
server.js:212 LDAPHandler ➔ info Wrong password for myuser
Contributor guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Assessment
This issue has not been assessed yet.