search

heiglandreas / authLdap

LDAP-Authentication for WordPress
http://andreas.heigl.org/cat/dev/wp/authldap/
MIT License
69 stars 38 forks source link

Save entered passwords in the wordpress user table #253

Closed gdessi1965 closed 4 months ago

gdessi1965 commented 4 months ago

Even if the checkbox for this feature is disabled, the password is still saved in the WordPress database.

Screenshot 2024-06-20 at 12 49 40
heiglandreas commented 4 months ago

Are you sure that THE password is saved in WordPress or just A password?

'Cause in https://github.com/heiglandreas/authLdap/blob/d411f9e5f99e01bfd56f3c6ff59442b15e6a809c/authLdap.php#L465-L471 we are explicitly setting a blank password for the user-info that will later be passed into the WordPress function wp_[update|insert]_user. And it might indeed happen that the empty password will then be hashed. So you will find a password hash in the database. It will just not be the hash of the password that the user entered.

But I might actually set that to a random string to avoid that a user might be able to log in with an empty password. Though, empty passwords aren't allowed anyhow, so whatever the user will enter it will not match...

gdessi1965 commented 4 months ago

Ah ok, no I didn't check that it was a randomly generated password just to not leave the field empty, thanks