Package home | Report new bug | New search | Development Roadmap Status: Open | Feedback | All | Closed Since Version 1.1.0

Request #13160 start() is inflexible
Submitted: 2008-02-21 01:00 UTC
From: shallot Assigned: mbretter
Status: Closed Package: Auth_RADIUS (version 1.0.5)
PHP Version: Irrelevant OS: Linux
Roadmaps: (Not assigned)    
Comments Add Comment Add patch

Anyone can comment on a bug. Have a simpler test case? Does it work for you on a different platform? Let us know! Just going to say 'Me too!'? Don't clutter the database with that please !
Your email address:
Solve the problem : 47 - 32 = ?

 [2008-02-21 01:00 UTC] shallot (Josip Rodin)
Description: ------------ The putStandardAttributes() function, invariably called by start(), is hardcoding a set of attributes into every request, some of which may not be useful for all users. For example, it's setting the Service-Type attribute to Framed-User, whereas people might reasonably wish to use Authenticate-Only. To do that now, one has to avoid start() and instead write one's own version, which is pointless and repetitive. Please make the putStandardAttributes() function optional, or allow its attribute values to be changed via parameters or something like that.


 [2008-02-21 02:34 UTC] shallot (Josip Rodin)
Another couple of problems I noticed in putStandardAttributes(): It sets RADIUS_NAS_IDENTIFIER to the $_SERVER['HTTP_HOST'] variable, which could be tainted as it contains the Host: header value in the request. It would be much better to not rely on those kinds of things and avoid passing rogue user input to the RADIUS server, and instead set RADIUS_NAS_IP_ADDRESS using the value of $_SERVER['SERVER_ADDR'] (if any; otherwise It also sets RADIUS_CALLING_STATION_ID to the $_SERVER['REMOTE_HOST'] variable, which is just wrong, because it depends on the web server doing a reverse DNS lookup on $_SERVER['REMOTE_ADDR'], and people generally don't do that any more (it's expensive). The code should just use the latter variable instead.
 [2008-04-13 10:35 UTC] mbretter (Michael Bretterklieber)
putStandardAttributes may now be turned off by setting the useStandardAttributes property to false
 [2008-04-13 10:35 UTC] mbretter (Michael Bretterklieber)
Thank you for your bug report. This issue has been fixed in the latest released version of the package, which you can download at