adam/Piwigo
1
0 Fork 0
mirror of https://github.com/Piwigo/Piwigo.git synced 2026-10-30 21:52:00 +01:00
Code Issues 657 Packages Projects Releases Wiki Activity

Bad handling of passwords with quote (') character #1089

New Issue
Open
opened 2026-10-05 00:31:04 +02:00 by adam · 2 comments
adam commented 2026-10-05 00:31:04 +02:00
Owner
Copy link
Copy source

Hi,

I'm using piwigo with the ldap plugin. One of my users have a quote (') in its password. Piwigo badly handles it by quoting it and not removing the quote. I did some tests and see that "let'sgo" is stored as "let'sgo" in $_POST['password'] (due to quote encoding) and it seems to never be decoded (same for $_POST['username'] even if I did not see a username with a quote)

I fixed my installation with this patch :

diff --git a/piwigo/identification.php b/piwigo/identification.php
index 9059ef2..84a2ac1 100644
--- a/piwigo/identification.php
+++ b/piwigo/identification.php
@@ -60,7 +60,7 @@ if (isset($_POST['login']))
     $redirect_to = isset($_POST['redirect']) ? urldecode($_POST['redirect']) : '';
     $remember_me = isset($_POST['remember_me']) and $_POST['remember_me']==1;
 
-    if ( try_log_user($_POST['username'], $_POST['password'], $remember_me) )
+    if ( try_log_user(stripcslashes($_POST['username']), stripcslashes($_POST['password']), $remember_me) )
     {
       // security (level 2): force redirect within Piwigo. We redirect to
       // absolute root url, including http(s)://, without the cookie path,

I found strange that piwigo use magic quoting (doing it manually if it is disabled on the server) instead of properly managing input and doing quoting when required (SQL requests, ...)

Regards
Vincent

Hi, I'm using piwigo with the ldap plugin. One of my users have a quote (') in its password. Piwigo badly handles it by quoting it and not removing the quote. I did some tests and see that "let'sgo" is stored as "let\'sgo" in $_POST['password'] (due to quote encoding) and it seems to never be decoded (same for $_POST['username'] even if I did not see a username with a quote) I fixed my installation with this patch : ```php diff --git a/piwigo/identification.php b/piwigo/identification.php index 9059ef2..84a2ac1 100644 --- a/piwigo/identification.php +++ b/piwigo/identification.php @@ -60,7 +60,7 @@ if (isset($_POST['login'])) $redirect_to = isset($_POST['redirect']) ? urldecode($_POST['redirect']) : ''; $remember_me = isset($_POST['remember_me']) and $_POST['remember_me']==1; - if ( try_log_user($_POST['username'], $_POST['password'], $remember_me) ) + if ( try_log_user(stripcslashes($_POST['username']), stripcslashes($_POST['password']), $remember_me) ) { // security (level 2): force redirect within Piwigo. We redirect to // absolute root url, including http(s)://, without the cookie path, ``` I found strange that piwigo use magic quoting (doing it manually if it is disabled on the server) instead of properly managing input and doing quoting when required (SQL requests, ...) Regards Vincent <!-- github-sync-id:741064313 -->
adam commented 2026-10-05 00:31:05 +02:00
Author
Owner
Copy link
Copy source

I second that one. I tried to install Piwigo with a MySQL user having a double quote in its password and had a hard time understanding why it was (silently) failing. Escaping is done way too early. It should be done only when writing files or SQL requests, not before.

I second that one. I tried to install Piwigo with a MySQL user having a double quote in its password and had a hard time understanding why it was (silently) failing. Escaping is done way too early. It should be done only when writing files or SQL requests, not before. <!-- github-comment-id:844092673 -->
adam commented 2026-10-05 00:31:05 +02:00
Author
Owner
Copy link
Copy source

I've experienced the same issue and fixed it by adding missing stripslashes, not in identification.php but in pwg_login(), as it's done in other piwigo functions. It's in the pull request above.

I'm also surprised by piwigo's custom magic quoting, but it can work and prevents security leaks due to lack of escaping. Instead we have "safe" bugs due to excessive escaping.

I've experienced the same issue and fixed it by adding missing stripslashes, not in identification.php but in pwg_login(), as it's done in other piwigo functions. It's in the pull request above. I'm also surprised by piwigo's custom magic quoting, but it can work and prevents security leaks due to lack of escaping. Instead we have "safe" bugs due to excessive escaping. <!-- github-comment-id:1377582410 -->
Sign in to join this conversation.
No Branch/Tag Specified
Labels
No items
No labels
Milestone
No items
No Milestone
Projects
Clear projects
No projects
Assignees
Clear assignees
adam (Adam Wojcieszonek)
No Assignees
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: adam/Piwigo#1089