search

lad1337 / XDM

XDM: eXtendable Download Manager. Plugin based media collection manager.
xdm.lad1337.de
Other
203 stars 46 forks source link

Logon fails if password is all numbers #159

Open nikorc opened 10 years ago

nikorc commented 10 years ago

When I set the password to be all numbers I am unable to log on to XDM. The value is entered into the database in column '_value_int' while password with characters and numbers are entered under'_value_char'.

pannal commented 10 years ago

That's a core-design-issue as XDM determines its config values/types/db-storage based on what has been entered by the user. This should be fixed in a later version as it implies several severe problems/bugs.

It leads to exactly those problems you describe by design flaw.

XDM doesn't know of field-types in any way connected to the stuff it saves to the database. It merely always "guesses" on what's been entered in the UI.

This basically determines what to save to the database: https://github.com/lad1337/XDM/blob/master/xdm/helper.py#L306

That not only leads to weird problems (as your issue with number-only passwords), but also to severe security issues, as the helper function never really knows about the type of value to be saved to the database.

I'd volunteer to fix all of those design-flaws if I had the time to...

lad1337 commented 10 years ago

there is also the attempt from torf to make the authentication process part of another system plugin

and yes the different types of the config is a design flaw :/