{"action":"created","issue":{"url":"https://api.github.com/repos/ngoduykhanh/PowerDNS-Admin/issues/133","repository_url":"https://api.github.com/repos/ngoduykhanh/PowerDNS-Admin","labels_url":"https://api.github.com/repos/ngoduykhanh/PowerDNS-Admin/issues/133/labels{/name}","comments_url":"https://api.github.com/repos/ngoduykhanh/PowerDNS-Admin/issues/133/comments","events_url":"https://api.github.com/repos/ngoduykhanh/PowerDNS-Admin/issues/133/events","html_url":"https://github.com/ngoduykhanh/PowerDNS-Admin/issues/133","id":174685435,"number":133,"title":"LDAP password store in db as plain text","user":{"login":"unclev0va","id":21703651,"avatar_url":"https://avatars.githubusercontent.com/u/21703651?v=3","gravatar_id":"","url":"https://api.github.com/users/unclev0va","html_url":"https://github.com/unclev0va","followers_url":"https://api.github.com/users/unclev0va/followers","following_url":"https://api.github.com/users/unclev0va/following{/other_user}","gists_url":"https://api.github.com/users/unclev0va/gists{/gist_id}","starred_url":"https://api.github.com/users/unclev0va/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/unclev0va/subscriptions","organizations_url":"https://api.github.com/users/unclev0va/orgs","repos_url":"https://api.github.com/users/unclev0va/repos","events_url":"https://api.github.com/users/unclev0va/events{/privacy}","received_events_url":"https://api.github.com/users/unclev0va/received_events","type":"User","site_admin":false},"labels":[],"state":"open","locked":false,"assignee":null,"assignees":[],"milestone":null,"comments":3,"created_at":"2016-09-02T05:48:31Z","updated_at":"2016-09-03T21:35:24Z","closed_at":null,"body":"But if I create new user, password stored hashed.\r\nIn code:\r\n```\r\n    def create_user(self):\r\n        \"\"\"\r\n        If user logged in successfully via LDAP in the first time\r\n        We will create a local user (in DB) in order to manage user\r\n        profile such as name, roles,...\r\n        \"\"\"\r\n        db.session.add(self)\r\n        db.session.commit()\r\n```\r\n\r\nI fix this by add         \r\n`self.password = self.get_hashed_password(self.plain_text_password)`\r\nbefore \r\n`db.session.add(self)`"},"comment":{"url":"https://api.github.com/repos/ngoduykhanh/PowerDNS-Admin/issues/comments/244571083","html_url":"https://github.com/ngoduykhanh/PowerDNS-Admin/issues/133#issuecomment-244571083","issue_url":"https://api.github.com/repos/ngoduykhanh/PowerDNS-Admin/issues/133","id":244571083,"user":{"login":"jallakim","id":359918,"avatar_url":"https://avatars.githubusercontent.com/u/359918?v=3","gravatar_id":"","url":"https://api.github.com/users/jallakim","html_url":"https://github.com/jallakim","followers_url":"https://api.github.com/users/jallakim/followers","following_url":"https://api.github.com/users/jallakim/following{/other_user}","gists_url":"https://api.github.com/users/jallakim/gists{/gist_id}","starred_url":"https://api.github.com/users/jallakim/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/jallakim/subscriptions","organizations_url":"https://api.github.com/users/jallakim/orgs","repos_url":"https://api.github.com/users/jallakim/repos","events_url":"https://api.github.com/users/jallakim/events{/privacy}","received_events_url":"https://api.github.com/users/jallakim/received_events","type":"User","site_admin":false},"created_at":"2016-09-03T21:35:23Z","updated_at":"2016-09-03T21:35:23Z","body":"@pschiffe, never thought about it from that angle before, but I guess most people utilize LDAP to be able to have the same password \"everywhere\". I know of several applications that caches users/passwords locally in order to facilitate login in case LDAP is unreachable (if user is deactivated in LDAP, and LDAP is reachable, the users won't be able to log in, of course -- so only in the event of an unreachable LDAP server).\r\n\r\nThe biggest issue here is that it's stored in plaintext, but I have no issue with removing it completely..."}}
{"actor":{"display_login":"jallakim"}}