View Issue Details

WikiRelated ChangesetsJump to Notes
IDProjectCategoryView StatusDate SubmittedLast Update
0013163mantisbtauthenticationpublic2011-07-21 08:322014-09-23 18:05
Reporterdregad Assigned Todregad  
PrioritylowSeverityminorReproducibilityN/A
Status closedResolutionfixed 
Product Version1.2.5 
Target Version1.2.6Fixed in Version1.2.6 
Summary0013163: Remove limitation on password length with MD5 authentication
Description

As suggested by user packman in 0013047, it does not make sense to limit the size of a user's password to the database field size (PASSLEN), when we are only storing a hash, the size of which is fixed.

The password size restriction only applies when we are storing the password itself in the database (e.g. deprecated PLAIN authentication method)

Tagspatch

Relationships

related to 0015721 closedgrangeway Functionality to consider porting to master-2.0.x 
has duplicate 0013100 closeddregad Password restricted to 32 characters 
related to 0013047 closeddregad PASSLEN constant doesn't match database field size 

Activities

grangeway

grangeway

2013-04-05 17:57

reporter   ~0036452

Marking as 'acknowledged' not resolved/closed to track that change gets ported to master-2.0.x branch

Related Changesets

MantisBT: master-1.2.x 4664aebf

2011-07-21 06:46

dregad


Details Diff		 Fix 0013163: Remove limitation on password length with MD5 authentication

A new function auth_get_password_max_size was added in authentication_api.php,
to return the maximum length of the password, taking the login method into
consideration: limited to the database field size (PASSLEN) for PLAIN and
BASIC_AUTH, or to new constant MAX_PASSWORD_SIZE for other, hash-based methods.

The return value is used to define the maxlength attribute of all the password
fields.		 Affected Issues
0013163
mod - account_page.php Diff File
mod - core/authentication_api.php Diff File
mod - core/constant_inc.php Diff File
mod - login_page.php Diff File
mod - manage_user_create_page.php Diff File

MantisBT: master 3c6b36e2

2011-07-21 06:46

dregad


Details Diff		 Fix 0013163: Remove limitation on password length with MD5 authentication

A new function auth_get_password_max_size was added in authentication_api.php,
to return the maximum length of the password, taking the login method into
consideration: limited to the database field size (PASSLEN) for PLAIN and
BASIC_AUTH, or to new constant MAX_PASSWORD_SIZE for other, hash-based methods.

The return value is used to define the maxlength attribute of all the password
fields.

This commit is a manual port to master of the changes in commits 4664aebf,
9c7fffbb, 5d527ef4 and b2c1c1e9		 Affected Issues
0013163
mod - account_page.php Diff File
mod - core/authentication_api.php Diff File
mod - core/constant_inc.php Diff File
mod - login_page.php Diff File
mod - manage_user_create_page.php Diff File
mod - manage_user_edit_page.php Diff File

MantisBT: master-1.2.x 9c7fffbb

2011-07-22 04:26

dregad


Details Diff		 Issue 0013163: cosmetic changes and fixing comments

Implementing vboctor's comments		 Affected Issues
0013163
mod - core/authentication_api.php Diff File
mod - core/constant_inc.php Diff File
mod - login_page.php Diff File

MantisBT: master-1.2.x 5d527ef4

2011-07-22 04:55

dregad


Details Diff		 Issue 0013163: handling login method HTTP_AUTH like PLAIN

Per vboctor's suggestion		 Affected Issues
0013163
mod - core/authentication_api.php Diff File

MantisBT: master-1.2.x b2c1c1e9

2011-07-22 05:06

dregad


Details Diff		 Issue 0013163: Increasing user+password fields size to 32 for consistency Affected Issues
0013163
mod - manage_user_edit_page.php Diff File