2ebeb4a Bug 829213 - unhashed#user#password visible after changing password https://bugzilla.redhat.com/show_bug.cgi?id=829213

7 files Authored by Noriko Hosoi 11 years ago, Committed by rmeggins 11 years ago,
    Bug 829213 - unhashed#user#password visible after changing password https://bugzilla.redhat.com/show_bug.cgi?id=829213
    
    Bug 830001 - unhashed#user#password visible after changing password [rhel-6.3]
    https://bugzilla.redhat.com/show_bug.cgi?id=830001
    
    Bug Description: unhashed password is stored in the entry in memory
    when an entry/a password is added or the password is modified.
    The password could be visible by the ordinary search if the type
    "unhashed#user#password" is specified in the attribute list.
    
    Fix Description:
    1. Set "unhashed#user#password" to the forbidden attribute list,
       which is dropped from the search attribute list.
    2. Get effective right does not return "unhashed#user#password"
    3. In the modify operation, adding "unhashed#user#password" to or
       deleting "unhashed#user#password" from the entry never returns
       an error regardless of the attribute value.  Internally, the
       operation is ignored.
    (cherry picked from commit 9df3c438ebd05bbaa5e7b2506fc5d5e9f3ff4a95)
    (cherry picked from commit 8f0811a86a1b233cf9566349653ef7f184278144)
    (Fixed conflicts in ldap/servers/slapd/{entry.c,entrywsi.c,slapi-private.h)
    (cherry picked from commit 8f9e49e73efb45f6741dee371b7dec3cd2fc1ddd)
    
        
file modified
+8 -1
file modified
+23 -3
file modified
+10 -2
file modified
+16 -0
file modified
+9 -6