Skip to content


Subversion checkout URL

You can clone with
Download ZIP
Commits on Apr 2, 2011
  1. @danielbr

    Disallow name="" in Content-Disposition header.

    danielbr committed
    Jon Jensen noticed that the last commit (b29f34f) introduced a new
    problem by relaxing the constraint a little too much and allowing
    empty strings. This patch by Mike Heins goes back to requiring at
    least one character, while still allowing 0.
  2. @danielbr

    Allow name="0" in Content-Disposition header.

    danielbr committed
    Interchange was checking the Content-Disposition name for perly truth
    rather than definedness, which caused it to incorrectly disallow the valid
    name of "0". I ran into one particular program in the wild that happens
    to generate requests with just such headers:

  3. @danielbr

    Enable case-insensitivity in UserDB for indirect_login.

    danielbr committed
    This patch allows catalogs that are using the indirect_login feature to
    combine that with ignore_case to enable case-insensitive logins.
    A common use-case is to have email address be the indirect login field, so
    one thing to be aware of is that it's legal for two separate e-mail
    addresses to differ in capitalization only (e.g. user@domain is distinct
    from User@domain).
  4. @danielbr
  5. @danielbr

    Enable case-insensitivity in UserDB for unencrypted passwords.

    danielbr committed
    This patch makes ignore_case function correctly on unencrypted passwords
    even when mixed-case passwords exist in the UserDB table.
    Currently, ignore_case only works if the stored passwords are lower case.
    There are at least two ways for mixed-case passwords to make it into the
    UserDB table:
     * If some user records were created with UserDB before ignore_case was set.
       (In this case, newer accounts get the expected behavior while older ones
       don't -- a recipe for "fun".)
     * If the password column is populated by more than just UserDB, such as
       through custom IC code or integration with other software.
    Case-insensitivity is a nice convenience; both for users who tend not to
    notice when caps lock has been toggled, and for help desk workers who field
    their calls. The cost is that it reduces the effective number of ASCII
    password characters by about one quarter. While it's true that it makes it
    ever so slightly easier to crack passwords, other factors (e.g. password
    length, use of dictionary words) far outweigh its importance.
    One alternative to this patch would be to change all current and future
    passwords in the UserDB table to lower case, then the existing ignore_case
    would suffice to provide case-insensitive functionality. One downside of
    that approach would be that it's irreversible, whereas this patch allows
    switching back and forth by simply changing the ignore_case configuration.
    This feature is enabled under the following example configuration:
    UserDB    default    crypt         0
    UserDB    default    ignore_case   1
  6. @danielbr

    Promote UserDB encryption methods from anonymous subs to named methods.

    danielbr committed
    The method body of md5_salted was long enough to justify its own named sub,
    and as soon as you do it for one of them, you know the rest are just going
    to whine until they get it too. I prefer named subs for style anyway.
  7. @danielbr

    Add salted md5 password support to UserDB.

    danielbr committed
    The specific format used here is to store the password and salt in a single
    field, separated by a colon. I used it to convert a Zen Cart store to
    To use this feature, set the following catalog configuration parameters:
    UserDB    default    md5_salted    1
    UserDB    default    crypt         1
  8. @danielbr
Something went wrong with that request. Please try again.