Description: ------------ Due to $password being trim()'d before being validated, a password that begins or ends in a space (or any whitespace) is not validated correctly. The second trim is alright if using MD5() crypting, but will cause problems if using no crypting. ie $password1 == $password2 Reproduce code: --------------- http://cvs.php.net/annotate.php/pear/Auth/Container/DB.php?rev=1.38 Line 256 of DB.php and similar in MDB.php if ($this->verifyPassword(trim($password), trim($res[$this->options['passwordcol']]), $this->options['cryptType'])) { Expected result: ---------------- The user should be authenticated. Should be validating MD5('test ') not MD5('test')

This bug has been fixed in CVS. In case this was a documentation problem, the fix will show up at the end of next Sunday (CET) on pear.php.net. In case this was a pear.php.net website problem, the change will show up on the website in short time. Thank you for the report, and for helping us make PEAR better. Fixed bugs in DB and MDB container changed trim($password) to trim($password, "\r\n") to trim only new line and carriage return chars, am not sure if trim is really needed there thou. Yavo