Changeset 2282 for trunk/LATMOS-Accounts/lib/LATMOS

Timestamp:

09/02/19 20:11:12 (5 years ago)

Author:

nanardon

Message:

Ensure users cannot retrieve password, even encrypted

Location:

trunk/LATMOS-Accounts/lib/LATMOS/Accounts

Files:

• Acls.pm (modified) (1 diff)
• Bases.pm (modified) (1 diff)
• Bases/Objects.pm (modified) (1 diff)

trunk/LATMOS-Accounts/lib/LATMOS/Accounts/Acls.pm

@@ -29 +29 @@
         }, $class
     );
-    if ($file) {
-        $acls->read_acl_file($file) or return;
-    }
 
     # Default ACLS:
-    $acls->add( '*.log', [ '$uid: read', '*: deny' ] );
+#    $acls->add( '*.log', [ '$uid: read', '*: deny' ] );
     $acls->add(
         'user.{userPasswd,userPassword,encryptedPassword,oldPassword}',
         [ '$uid: write', '*: deny' ],
     );
+
+    if ($file) {
+        $acls->read_acl_file($file) or return;
+    }
+
     $acls
 }

trunk/LATMOS-Accounts/lib/LATMOS/Accounts/Bases.pm

@@ -1185 +1185 @@
     my ($self, $username) = @_;
 
-    $self->{_user} = $username;
-    la_log(LA_DEBUG, "Connected as $username");
+    $self->{_user} = $username || '';
+    la_log(LA_DEBUG, "Connected as `$username'");
 }
 

trunk/LATMOS-Accounts/lib/LATMOS/Accounts/Bases/Objects.pm

@@ -240 +240 @@
     my ($self, $cfield) = @_;
     $self->base->check_acl($self, $cfield, 'r') or do {
-        $self->base->log(LA_ERR, "Permission denied to get %s/%s",
+        $self->base->log(LA_DEBUG, "Permission denied to get %s/%s",
             $self->id, $cfield
         );