Skip to content

fog-plugins v1.6.2

Choose a tag to compare

View all tags
@mastacontrola mastacontrola released this 13 Aug 17:16
· 28 commits to main since this release
v1.6.2
3b48e61

The LDAP plugin declares its own bind password as an API secret, through the API_SENSITIVE_FIELDS hook.

Pairs with FOGProject/fogproject#1025 and must not be skipped. That PR removes the hardcoded 'ldap' => 'bindPwd' entry from Route::$sensitiveAlwaysFields — core naming a plugin is what the plugin architecture exists to end. Without this release present, core dropping that entry means the LDAP bind password, a directory service account credential stored in cleartext, stops being stripped from API payloads.

#1025 bumps FOG_PLUGINS_VERSION to v1.6.2 in the same PR, so an installer run applies both halves together.

Only ldap/hooks/addldapapi.hook.php differs from v1.6.1.

Assets 4
Loading