[...]"ldap_host":"REDACTED","ldap_basedn":"REDACTED","ldap_rootdn":"REDACTED","ldap_pass":"REDACTED"[...]
For the record, I join the dump of my GLPI setup information.
GLPI 9.5.5 ( => /var/www/intervs)
Installation mode: TARBALL
Server
Operating system: Linux serv-intervs 4.19.0-17-amd64 #1 SMP Debian 4.19.194-3 (2021-07-18) x86_64
PHP 7.3.29-1~deb10u1 fpm-fcgi (Core, PDO, Phar, Reflection, SPL, SimpleXML, Zend OPcache, apc, apcu, bz2, calendar, cgi-fcgi,
ctype, curl, date, dom, exif, fileinfo, filter, ftp, gd, gettext, hash, iconv, imap, intl, json, ldap, libxml, mbstring, mysqli,
mysqlnd, openssl, pcre, pdo_mysql, posix, readline, session, shmop, sockets, sodium, standard, sysvmsg, sysvsem, sysvshm,
tokenizer, wddx, xml, xmlreader, xmlrpc, xmlwriter, xsl, zip, zlib)
Setup: max_execution_time="30" memory_limit="128M" post_max_size="8M" safe_mode="" session.save_handler="files"
upload_max_filesize="2M"
Software: Apache ()
Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:96.0) Gecko/20100101 Firefox/96.0
Server Software: Debian 10
Server Version: 10.3.29-MariaDB-0+deb10u1
Server SQL Mode:
Parameters: glpi@localhost/glpi
Host info: Localhost via UNIX socket
PHP version is at least 7.2.0 - Perfect!PHP version is at least 7.2.0 - Perfect!
Sessions support is available - Perfect!Sessions support is available - Perfect!
Allocated memory > 64 Mio - Perfect!Allocated memory > 64 Mio - Perfect!
mysqli extension is installedmysqli extension is installed
ctype extension is installedctype extension is installed
fileinfo extension is installedfileinfo extension is installed
json extension is installedjson extension is installed
mbstring extension is installedmbstring extension is installed
iconv extension is installediconv extension is installed
zlib extension is installedzlib extension is installed
curl extension is installedcurl extension is installed
gd extension is installedgd extension is installed
simplexml extension is installedsimplexml extension is installed
intl extension is installedintl extension is installed
ldap extension is installedldap extension is installed
apcu extension is installedapcu extension is installed
Zend OPcache extension is installedZend OPcache extension is installed
xmlrpc extension is installedxmlrpc extension is installed
CAS extension is installedCAS extension is installed
exif extension is installedexif extension is installed
zip extension is installedzip extension is installed
bz2 extension is installedbz2 extension is installed
sodium extension is installedsodium extension is installed
Database version seems correct (10.3.29) - Perfect!Database version seems correct (10.3.29) - Perfect!
Timezones seems loaded in databaseTimezones seems loaded in database
The log file has been created successfully.The log file has been created successfully.
Write access to /var/www/intervs/files/_cache has been validated.Write access to /var/www/intervs/files/_cache has been validated.
Write access to /var/www/intervs/config has been validated.Write access to /var/www/intervs/config has been validated.
Write access to /var/www/intervs/files/_cron has been validated.Write access to /var/www/intervs/files/_cron has been validated.
Write access to /var/www/intervs/files has been validated.Write access to /var/www/intervs/files has been validated.
Write access to /var/www/intervs/files/_dumps has been validated.Write access to /var/www/intervs/files/_dumps has been validated.
Write access to /var/www/intervs/files/_graphs has been validated.Write access to /var/www/intervs/files/_graphs has been validated.
Write access to /var/www/intervs/files/_lock has been validated.Write access to /var/www/intervs/files/_lock has been validated.
Write access to /var/www/intervs/files/_pictures has been validated.Write access to /var/www/intervs/files/_pictures has been validated.
Write access to /var/www/intervs/files/_plugins has been validated.Write access to /var/www/intervs/files/_plugins has been validated.
Write access to /var/www/intervs/files/_rss has been validated.Write access to /var/www/intervs/files/_rss has been validated.
Write access to /var/www/intervs/files/_sessions has been validated.Write access to /var/www/intervs/files/_sessions has been validated.
Write access to /var/www/intervs/files/_tmp has been validated.Write access to /var/www/intervs/files/_tmp has been validated.
Write access to /var/www/intervs/files/_uploads has been validated.Write access to /var/www/intervs/files/_uploads has been validated.
Write access to /var/www/intervs/marketplace has been validated.Write access to /var/www/intervs/marketplace has been validated.
Web access to the files directory should not be allowed but this cannot be checked automatically on this instance. Make sure access to error log file (/files/_log/php-errors.log) is forbidden; otherwise review .htaccess file and web server configuration.Web access to the files directory should not be allowed but this cannot be checked automatically on this instance.
Make sure access to error log file (/files/_log/php-errors.log) is forbidden; otherwise review .htaccess file and web server configuration.
GLPI constants
GLPI_ROOT: /var/www/intervs
GLPI_CONFIG_DIR: /var/www/intervs/config
GLPI_VAR_DIR: /var/www/intervs/files
GLPI_MARKETPLACE_DIR: /var/www/intervs/marketplace
GLPI_USE_CSRF_CHECK: 1
GLPI_CSRF_EXPIRES: 7200
GLPI_CSRF_MAX_TOKENS: 100
GLPI_USE_IDOR_CHECK: 1
GLPI_IDOR_EXPIRES: 7200
GLPI_ALLOW_IFRAME_IN_RICH_TEXT:
GLPI_TELEMETRY_URI: https://telemetry.glpi-project.org
GLPI_INSTALL_MODE: TARBALL
GLPI_NETWORK_MAIL: glpi@teclib.com
GLPI_NETWORK_SERVICES: https://services.glpi-network.com
GLPI_MARKETPLACE_PRERELEASES:
GLPI_MARKETPLACE_ALLOW_OVERRIDE: 1
GLPI_MARKETPLACE_MANUAL_DOWNLOADS: 1
GLPI_USER_AGENT_EXTRA_COMMENTS:
GLPI_AJAX_DASHBOARD: 1
GLPI_CALDAV_IMPORT_STATE: 0
GLPI_DEMO_MODE: 0
GLPI_FORCE_EMPTY_SQL_MODE: 1
GLPI_DOC_DIR: /var/www/intervs/files
GLPI_CACHE_DIR: /var/www/intervs/files/_cache
GLPI_CRON_DIR: /var/www/intervs/files/_cron
GLPI_DUMP_DIR: /var/www/intervs/files/_dumps
GLPI_GRAPH_DIR: /var/www/intervs/files/_graphs
GLPI_LOCAL_I18N_DIR: /var/www/intervs/files/_locales
GLPI_LOCK_DIR: /var/www/intervs/files/_lock
GLPI_LOG_DIR: /var/www/intervs/files/_log
GLPI_PICTURE_DIR: /var/www/intervs/files/_pictures
GLPI_PLUGIN_DOC_DIR: /var/www/intervs/files/_plugins
GLPI_RSS_DIR: /var/www/intervs/files/_rss
GLPI_SESSION_DIR: /var/www/intervs/files/_sessions
GLPI_TMP_DIR: /var/www/intervs/files/_tmp
GLPI_UPLOAD_DIR: /var/www/intervs/files/_uploads
GLPI_NETWORK_REGISTRATION_API_URL: https://services.glpi-network.com/api/registration/
GLPI_MARKETPLACE_PLUGINS_API_URI: https://services.glpi-network.com/api/glpi-plugins/
GLPI_I18N_DIR: /var/www/intervs/locales
GLPI_VERSION: 9.5.5
GLPI_SCHEMA_VERSION: 9.5.5
GLPI_MIN_PHP: 7.2.0
GLPI_YEAR: 2021
Libraries
htmlawed/htmlawed version 1.2.5 in (/var/www/intervs/vendor/htmlawed/htmlawed)
phpmailer/phpmailer version 6.1.6 in (/var/www/intervs/vendor/phpmailer/phpmailer/src)
simplepie/simplepie version 1.5.6 in (/var/www/intervs/vendor/simplepie/simplepie/library)
tecnickcom/tcpdf version 6.3.5 in (/var/www/intervs/vendor/tecnickcom/tcpdf)
michelf/php-markdown in (/var/www/intervs/vendor/michelf/php-markdown/Michelf)
true/punycode in (/var/www/intervs/vendor/true/punycode/src)
iamcal/lib_autolink in (/var/www/intervs/vendor/iamcal/lib_autolink)
sabre/dav in (/var/www/intervs/vendor/sabre/dav/lib/DAV)
sabre/http in (/var/www/intervs/vendor/sabre/http/lib)
sabre/uri in (/var/www/intervs/vendor/sabre/uri/lib)
sabre/vobject in (/var/www/intervs/vendor/sabre/vobject/lib)
laminas/laminas-cache in (/var/www/intervs/vendor/laminas/laminas-cache/src)
laminas/laminas-i18n in (/var/www/intervs/vendor/laminas/laminas-i18n/src)
laminas/laminas-serializer in (/var/www/intervs/vendor/laminas/laminas-serializer/src)
monolog/monolog in (/var/www/intervs/vendor/monolog/monolog/src/Monolog)
sebastian/diff in (/var/www/intervs/vendor/sebastian/diff/src)
elvanto/litemoji in (/var/www/intervs/vendor/elvanto/litemoji/src)
symfony/console in (/var/www/intervs/vendor/symfony/console)
scssphp/scssphp in (/var/www/intervs/vendor/scssphp/scssphp/src)
laminas/laminas-mail in (/var/www/intervs/vendor/laminas/laminas-mail/src/Protocol)
laminas/laminas-mime in (/var/www/intervs/vendor/laminas/laminas-mime/src)
rlanvin/php-rrule in (/var/www/intervs/vendor/rlanvin/php-rrule/src)
blueimp/jquery-file-upload in (/var/www/intervs/vendor/blueimp/jquery-file-upload/server/php)
ramsey/uuid in (/var/www/intervs/vendor/ramsey/uuid/src)
psr/log in (/var/www/intervs/vendor/psr/log/Psr/Log)
psr/simple-cache in (/var/www/intervs/vendor/psr/simple-cache/src)
mexitek/phpcolors in (/var/www/intervs/vendor/mexitek/phpcolors/src/Mexitek/PHPColors)
guzzlehttp/guzzle in (/var/www/intervs/vendor/guzzlehttp/guzzle/src)
guzzlehttp/psr7 in (/var/www/intervs/vendor/guzzlehttp/psr7/src)
wapmorgan/unified-archive in (/var/www/intervs/vendor/wapmorgan/unified-archive/src)
paragonie/sodium_compat in (/var/www/intervs/vendor/paragonie/sodium_compat/src)
phpCas version 1.3.6 in (/usr/share/php/CAS/source)
LDAP directories
Server: '10.5.0.2', Port: '389', BaseDN: 'ou=REDACTED,dc=REDACTED,dc=fr', Connection filter:
'(&(objectClass=user)(objectCategory=person)(!(userAccountControl:1.2.840.113556.1.4.803:=2)))', RootDN: 'CN= REDACTED,OU=REDACTED,OU=REDACTED,OU=REDACTED,DC=REDACTED,DC=fr', Use TLS: none
SQL replicas
Not active
Notifications
Way of sending emails: SMTP (anonymous@10.5.212.129)
Mails receivers
Plugins list
compte Name: Version: 1.4 State: Error / to clean
immo Name: Version: 1.1 State: Error / to clean
manageentity Name: Version: 1.4 State: Error / to clean
ticketreport Name: Version: 1.1 State: Error / to clean
treeview Name: Version: 1.1 State: Error / to clean
archires Name: Architectures réseau Version: 2.4.0 State: Error / to clean
behaviors Name: Comportements Version: 2.5.0 State: Enabled
formcreator Name: Form Creator Version: 2.12.0 State: Enabled
genericobject Name: Gestion d'objets Version: 2.11.0 State: Enabled
order Name: Gestion des commandes Version: 2.7.0 State: Enabled
pdf Name: Impression pdf Version: 2.0.0 State: Enabled
ocsinventoryng Name: OCS Inventory NG Version: 1.7.3 State: Enabled
reports Name: Rapports Version: 1.14.1 State: Enabled
relations Name: Relations Version: 1.2.0 State: Error / to clean
resources Name: Ressources humaines Version: 2.7.0 State: Enabled
OCS Inventory NG
Host: 10.5.0.10
Connection: Ok
Use the OCSNG software dictionary: No
Host: 10.5.0.10
Connection: Ok
Use the OCSNG software dictionary: No
When you pass the config to the javascript, some entries are filtered
out. The variable
ldap_pass
is not filtered and when you look at thesource code of the page, we can see the password for the root dn
If I understand correctly, when the footer is loaded1, the js variable
CFG_GLPI is populated2 with some of the variables filtered out3
Problem is, the
ldap_pass
is not filtered and when I check the page'ssource, I can see all the ldap informations :
(of course, the informations are in plaintext)
For the record, I join the dump of my GLPI setup information.