Mailing List Archive

commit de456880f8ec7a60d28e4b01e667334a4cbc632e
Author: Josh Lavin <digory@cpan.org>
Date: Mon Oct 31 14:17:37 2016 -0700

Turn off UserDB ignore_case

- As this stores username/password in lowercase, it is not great for
security. Also it has the effect of preventing password changes once you
toggle it.
- If there were an option to standardize the case of usernames on login,
that would be nice. But affecting passwords as well is not what we
want here.

dist/strap/catalog.cfg | 3 +--
1 files changed, 1 insertions(+), 2 deletions(-)
---
diff --git a/dist/strap/catalog.cfg b/dist/strap/catalog.cfg
index 693891a..1e10caa 100644
--- a/dist/strap/catalog.cfg
+++ b/dist/strap/catalog.cfg
@@ -270,7 +270,7 @@ UserDB default from_plain 1
UserDB default bcrypt_pepper __BCRYPT_PEPPER__

# Set to 1 to make the username and password case-insensitive
-UserDB default ignore_case 1
+UserDB default ignore_case 0

# Change a field to something that doesn't conflict in MySQL
UserDB default time_field mod_time
@@ -304,7 +304,6 @@ EOU
UserDB default logfile logs/userdb.log

# This makes the login username the user's email address
-# Uncomment to use
UserDB default indirect_login usernick
UserDB default assign_username 1


_______________________________________________
interchange-cvs mailing list
interchange-cvs@icdevgroup.org
http://www.icdevgroup.org/mailman/listinfo/interchange-cvs