Successfull login into Gitblit again under valid Redmine login and invalid password after the second login

[gitblit]

Originally reported on Google Code with ID 387

What steps will reproduce the problem?
1. First time successfull login into Gitblit under valid Redmine account pair (login
& password). 
2. Close browser and open it again.
3. Successfull login into Gitblit again under valid Redmine login and invalid password
 (!!!)

What is the expected output? What do you see instead?
I should be blocked in case of usage invalid Redmine password for valid account.

What version of the product are you using? On what operating system?
CentOS 5 with latest udpates, Gitblit 1.4.0 behind Apache reverse proxy (interconnection
through AJP/13 port tcp/8009), Redmine 1.3.1

Please provide any additional information below.
I'm not sure, but it can be global bug for all external authentication or just for
Redmine.

Reported by shumal.av on 2014-03-18 04:15:29

[gitblit]

The second login is probably cookie authentication.  Try disabling cookies or repeating
this test in two private browsing sessions.

Reported by James.Moger on 2014-03-18 12:11:14

[gitblit]

I'm seeing a similar issue with LDAP authentication.

Even if I delete the Gitblit and JSESSIONID cookies before trying to log in again,
using an invalid password always lets me back in.

Centos 6.5
Gitblit 1.4.0

NOTE: Gitblit 1.3.2 does not exhibit this behaviour in my testing. We currently have
1.3.2 in production. 

Reported by kaosagnt on 2014-03-18 23:13:54

[gitblit]

Hmmm.  Sounds there is a systemic problem here.

Reported by James.Moger on 2014-03-19 00:02:12

• Status changed: Accepted
• Labels added: Milestone-1.4.1

[gitblit]

I've reproduced this in a unit test.  Fix to follow.

Reported by James.Moger on 2014-03-19 00:11:35

[gitblit]

The fix as been pushed to master.  I'm firing up the release machinery.  Look for 1.4.1
shortly.

Reported by James.Moger on 2014-03-19 01:17:50

• Status changed: Queued

[gitblit]

Sweet, thanks for looking into this so quickly.

Reported by kaosagnt on 2014-03-19 01:38:57

[gitblit]

v1.4.1 released with a critical security fix.  Please update.

Reported by James.Moger on 2014-03-19 02:15:48

• Status changed: Done