{"action":"created","issue":{"url":"https://api.github.com/repos/librenms/librenms/issues/4784","repository_url":"https://api.github.com/repos/librenms/librenms","labels_url":"https://api.github.com/repos/librenms/librenms/issues/4784/labels{/name}","comments_url":"https://api.github.com/repos/librenms/librenms/issues/4784/comments","events_url":"https://api.github.com/repos/librenms/librenms/issues/4784/events","html_url":"https://github.com/librenms/librenms/pull/4784","id":182644125,"number":4784,"title":"Prevent accidental anonymous binds","user":{"login":"jonathon-k","id":21371455,"avatar_url":"https://avatars.githubusercontent.com/u/21371455?v=3","gravatar_id":"","url":"https://api.github.com/users/jonathon-k","html_url":"https://github.com/jonathon-k","followers_url":"https://api.github.com/users/jonathon-k/followers","following_url":"https://api.github.com/users/jonathon-k/following{/other_user}","gists_url":"https://api.github.com/users/jonathon-k/gists{/gist_id}","starred_url":"https://api.github.com/users/jonathon-k/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/jonathon-k/subscriptions","organizations_url":"https://api.github.com/users/jonathon-k/orgs","repos_url":"https://api.github.com/users/jonathon-k/repos","events_url":"https://api.github.com/users/jonathon-k/events{/privacy}","received_events_url":"https://api.github.com/users/jonathon-k/received_events","type":"User","site_admin":false},"labels":[],"state":"closed","locked":false,"assignee":null,"assignees":[],"milestone":null,"comments":8,"created_at":"2016-10-12T21:55:05Z","updated_at":"2016-10-13T17:49:14Z","closed_at":"2016-10-13T15:19:36Z","pull_request":{"url":"https://api.github.com/repos/librenms/librenms/pulls/4784","html_url":"https://github.com/librenms/librenms/pull/4784","diff_url":"https://github.com/librenms/librenms/pull/4784.diff","patch_url":"https://github.com/librenms/librenms/pull/4784.patch"},"body":"#### Please note\r\n\r\n> Please read this information carefully. You can run `./scripts/pre-commit.php` to check your code before submitting.\r\n\r\n- [x] Have you signed the [Contributors agreement](http://docs.librenms.org/General/Contributing/)\r\n- [x] Have you followed our [code guidelines?](http://docs.librenms.org/Developing/Code-Guidelines/)\r\n\r\nBy design, or by bug, PHP's ldap_bind function will automatically attempt an anonymous bind if either the bind_rdn (username) or bind_password arguments are empty.   This behavior may allow a non-existent user to authenticate to librenms with minimal (Level 1?) privileges.\r\n\r\nProposed fix -- Enforce a non-blank password when authenticating via ldap or active directory."},"comment":{"url":"https://api.github.com/repos/librenms/librenms/issues/comments/253586690","html_url":"https://github.com/librenms/librenms/pull/4784#issuecomment-253586690","issue_url":"https://api.github.com/repos/librenms/librenms/issues/4784","id":253586690,"user":{"login":"Gorian","id":1012176,"avatar_url":"https://avatars.githubusercontent.com/u/1012176?v=3","gravatar_id":"","url":"https://api.github.com/users/Gorian","html_url":"https://github.com/Gorian","followers_url":"https://api.github.com/users/Gorian/followers","following_url":"https://api.github.com/users/Gorian/following{/other_user}","gists_url":"https://api.github.com/users/Gorian/gists{/gist_id}","starred_url":"https://api.github.com/users/Gorian/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/Gorian/subscriptions","organizations_url":"https://api.github.com/users/Gorian/orgs","repos_url":"https://api.github.com/users/Gorian/repos","events_url":"https://api.github.com/users/Gorian/events{/privacy}","received_events_url":"https://api.github.com/users/Gorian/received_events","type":"User","site_admin":false},"created_at":"2016-10-13T17:49:14Z","updated_at":"2016-10-13T17:49:14Z","body":"So, I set that to 0 on purpose - but the assumption is, if someone can successfully authenticate to the domain with a valid username and password, they can login. Not that a random string of characters in the \"username\" box would allow access. If people don't have an account on this particular AD, they shouldn't be able to login. I'm not sure if that's the expected behaviour and it's not communicated well in documentation, or if it's a bug in that particular feature..."}}
{"actor":{"display_login":"Gorian"}}