| Package home | Report new bug | New search | Development Roadmap | Status: Open | Feedback | All | Closed Since Version 1.3.8 |
| Bug #2175 | login() which uses DIGEST-MD5 always returns true. | ||
|---|---|---|---|
| Submitted: | 2004-08-20 12:15 UTC | ||
| From: | kmizuno9999 at yahoo dot co dot jp | Assigned: | damian |
| Status: | No Feedback | Package: | Net_POP3 |
| PHP Version: | 4.3.7 | OS: | Windows XP |
| Roadmaps: | (Not assigned) | ||
[2004-08-20 12:15 UTC] kmizuno9999 at yahoo dot co dot jp
Description:
------------
The login() method which uses DIGEST-MD5 regardless of server response returns true.
This situation is caused when the client sends invalid user or password.
The version number is 1.3.2
When mailserver returned "ERR" response, the method should return "false".
in _authDigest_MD5()
------------------------------------------------------------ if ( PEAR::isError($error = $this->_send( $auth_str ) ) ) {
return $error;
}
/**** here ****/
if ( PEAR::isError( $challenge = $this->_recvLn() ) ) { <-- it doesn't check server response.
/**** here ****/
return $challenge;
}
/*
* We don't use the protocol's third step because POP3 doesn't allow
* subsequent authentication, so we just silently ignore it.
*/
if ( PEAR::isError( $challenge = $this->_send("\r\n") ) ) {
return $challenge ;
}
/**** here ****/
if ( PEAR::isError( $challenge = $this->_recvLn() ) ) { <-- it doesn't check server response.
/**** here ****/
return $challenge;
}
return true;
------------------------------------------------------------
Comments
[2004-09-16 01:22 UTC] User who submitted this comment has not confirmed identity
If you submitted this note, check your email.If you do not have a message, click here to re-send MANUAL CONFIRMATION IS NOT POSSIBLE. Write a message to pear-dev@lists.php.net to request the confirmation link. All bugs/comments/patches associated with this email address will be deleted within 48 hours if the account request is not confirmed!