Login with expire password work if we modify the URL

The password of user 'c' is expired.

I try to login with 'c' and it is refused. I modify the URL <IP_FD>/fusiondirectory/index.php in <IP_FD>/fusiondirectory/main.php

And I connect with the user 'c'.

(from redmine: issue id 3263, created on 2014-08-08, closed on 2014-08-11)

• Changesets:
  • Revision 8fda542b by Côme Chilliet on 2014-08-11T07:56:03.000Z:

Fixes #3263 Fixed vulnerability in user expiration system

• Revision e6c5e67b by Côme Chilliet on 2014-08-11T07:56:53.000Z:

Fixes #3263 Fixed vulnerability in user expiration system

• Custom Fields:
  • Bug in version: 1.0.8
• Uploads:
  • 0001-Fixes-3263-Fixed-vulnerability-in-user-expiration-sy.patch

Hello,

applied to 1.0.8.1 and develop

Cheers

(from redmine: written on 2014-08-11)

By bmortier on 2017-09-02T15:12:25 (imported from GitLab)

Last patch work nice.

Close issue

(from redmine: written on 2014-08-11)

By Jonathan Swaelens on 2017-09-02T15:12:25 (imported from GitLab)

hello,

applied to 1.0.7.5-fixes in html/index.php and html/main.php

Cheers

(from redmine: written on 2014-12-03)

By bmortier on 2017-09-02T15:12:26 (imported from GitLab)

closed

By Jonathan Swaelens on 2017-09-02T15:12:26 (imported from GitLab)

added Security fusiondirectory-core labels

By bmortier on 2018-10-09T19:36:35 (imported from GitLab)

removed Bugs label

added FSA-0006 label

added FSA-0005 label and removed FSA-0006 label