{"action":"created","issue":{"url":"https://api.github.com/repos/mailwatch/1.2.0/issues/246","repository_url":"https://api.github.com/repos/mailwatch/1.2.0","labels_url":"https://api.github.com/repos/mailwatch/1.2.0/issues/246/labels{/name}","comments_url":"https://api.github.com/repos/mailwatch/1.2.0/issues/246/comments","events_url":"https://api.github.com/repos/mailwatch/1.2.0/issues/246/events","html_url":"https://github.com/mailwatch/1.2.0/issues/246","id":152459425,"number":246,"title":"Any password works when LDAP is enabled","user":{"login":"shawniverson","id":6255179,"avatar_url":"https://avatars.githubusercontent.com/u/6255179?v=3","gravatar_id":"","url":"https://api.github.com/users/shawniverson","html_url":"https://github.com/shawniverson","followers_url":"https://api.github.com/users/shawniverson/followers","following_url":"https://api.github.com/users/shawniverson/following{/other_user}","gists_url":"https://api.github.com/users/shawniverson/gists{/gist_id}","starred_url":"https://api.github.com/users/shawniverson/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/shawniverson/subscriptions","organizations_url":"https://api.github.com/users/shawniverson/orgs","repos_url":"https://api.github.com/users/shawniverson/repos","events_url":"https://api.github.com/users/shawniverson/events{/privacy}","received_events_url":"https://api.github.com/users/shawniverson/received_events","type":"User","site_admin":false},"labels":[],"state":"closed","locked":false,"assignee":null,"milestone":null,"comments":1,"created_at":"2016-05-01T22:37:54Z","updated_at":"2016-05-02T08:12:57Z","closed_at":"2016-05-02T08:02:34Z","body":"When USE_LDAP is set to true, a fault in the new logic of checklogin.php allows anyone to log in with any password.\r\n\r\nProblem is on line 77 in which the password checking routine is enclosed within  if (USE_LDAP === false). \r\n\r\nTherefore, it doesn't matter if LDAP auth above succeeds or fails, user is given a login success regardless\r\n"},"comment":{"url":"https://api.github.com/repos/mailwatch/1.2.0/issues/comments/216131177","html_url":"https://github.com/mailwatch/1.2.0/issues/246#issuecomment-216131177","issue_url":"https://api.github.com/repos/mailwatch/1.2.0/issues/246","id":216131177,"user":{"login":"endelwar","id":28512,"avatar_url":"https://avatars.githubusercontent.com/u/28512?v=3","gravatar_id":"","url":"https://api.github.com/users/endelwar","html_url":"https://github.com/endelwar","followers_url":"https://api.github.com/users/endelwar/followers","following_url":"https://api.github.com/users/endelwar/following{/other_user}","gists_url":"https://api.github.com/users/endelwar/gists{/gist_id}","starred_url":"https://api.github.com/users/endelwar/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/endelwar/subscriptions","organizations_url":"https://api.github.com/users/endelwar/orgs","repos_url":"https://api.github.com/users/endelwar/repos","events_url":"https://api.github.com/users/endelwar/events{/privacy}","received_events_url":"https://api.github.com/users/endelwar/received_events","type":"User","site_admin":false},"created_at":"2016-05-02T08:12:57Z","updated_at":"2016-05-02T08:12:57Z","body":"Thanks, fixed in master and development branches"}}