Patch #21312

Fix exception in Redmine.pm when authenticating anonymous users

Added by Holger Just over 2 years ago. Updated over 2 years ago.

Status:ClosedStart date:
Priority:NormalDue date:
Assignee:Jean-Philippe Lang% Done:

0%

Category:SCM extra
Target version:2.6.9

Description

The is_member function in Redmine.pm searches users which have the required permissions to access the repository. The used SQL however doesn't restrict the returned data to actual users but includes groups as well. This results in the following exception:

[perl:error] [pid 29442] [client 127.0.0.1:49599] Use of uninitialized value $salt in concatenation (.) or string at /usr/share/perl5/Apache/Redmine.pm line 483.\n

If the user doesn't provide a login here, it defaults to an empty string in the query. Unfortunately, an empty login applies to both the Anonymous user as well as all groups. Thus, if there are any groups, this can result in multiple lines being returned as a SQL result set that do not belong to actual users.

The attached patch by Planio fixes the SQL query so that only actual users are queried here.

0001-Only-select-actual-users-from-the-database-in-Redmin.patch Magnifier (871 Bytes) Holger Just, 2015-11-24 15:03

Associated revisions

Revision 14892
Added by Jean-Philippe Lang over 2 years ago

Only select actual users from the database in Redmine.pm (#21312).

Patch by Holger Just.

History

#1 Updated by Jan from Planio www.plan.io over 2 years ago

  • Target version set to Candidate for next minor release

#2 Updated by Jean-Philippe Lang over 2 years ago

  • Status changed from New to Resolved
  • Assignee set to Jean-Philippe Lang
  • Target version changed from Candidate for next minor release to 2.6.9

#3 Updated by Jean-Philippe Lang over 2 years ago

  • Status changed from Resolved to Closed

Also available in: Atom PDF