[Fwd: Re: [sork] patch: customsql option and other goodies]

[Kendrick Vargas]

Woops, sorry, meant to send this to the list, but I sent it directly to Eric 
instead. Sorry about that Eric :-)

Eric Rostetter wrote:
> Quoting Jan Schneider <jan at horde.org>:
> 
>> The driver that needs credentials to work can take a look at the
>> configuration to see if horde auth is enabled. In this case it knows that
>> it doesn't need a password and needsPassword() (or whatever) returns 
>> false,
>> otherwise true.
> 
> 
> This only covers the case of horde auth (which I forgot about actually).
> 
>> Jan.
> 
> 
> Some things to think about.
> 
> * Why would forwards say:
> 
>   For your protection and safety, you must identify yourself with your 
> login
>   password to verify this change.  Then submit the form so that your 
> forward
>   can be updated.
> 
> if the password wasn't there for security reasons?
> 
> * How would not allowing a password be used with guest logins?
> 
> * How would not allowing a password in the module work if Horde doesn't
> require a password?
> 
> * Do you really want people changing your account on another server
> just because they have access to your horde login?  (Think, stupid user
> leaves horde/IMP logged in and walks away from the computer to get a drink
> or something; next person walks up and redirects all his mail without their
> knowledge as a malicious endevour).
> 
> * There could be issues with session/tcp/etc hijacking, etc.
> 
> I'm very sure that *many* people want to do away with these password 
> checks.
> However, I'm sure there are a small number of security conscious people who
> really want to keep the password check in the sork modules, though we'd
> allow it to be optional for the others...

The patch I submitted made the password requirement an OPTION. I.e... if you
checked the password requirement option in the configuration screen, then
you had a password requirement.

All your points above are valid, but just as they create problems in some
situations, they don't hold water in others. If a Horde installation has IMP
installed (which I imagine is the primary reason most people install Horde),
with automatic authentication then a passer-by allready has access to the
users' email. Having access to a users' forward setting is just as bad as
having access to the users' INBOX.

Maybe there should be better integration between IMP and whatever is
designated as providing forwards (which, for all intents and purposes could
also be a sieve filter in ingo) so that IMP could show "Your E-Mail is
currently being forwarded" could come across the top of the INBOX.

In any case, it should be the decision of the site administrator, not the
developer, whether or not to require the user enter a password. In my case,
I don't see a reason for requiring a password. It is no more or less secure
with the other modules I have installed being open.

Maybe instead of having a checkbox to require a password or not, there
should be two options in the configuration area for authentication:

	* Assume Horde Username (if available) as Username

	* Assume Horde Password (if available) as Password

Then, using a method of some sort, request both the username and password.
This method would look for the username and password and return a value or
false if unset. The form requesting a forwarding change could then be
autogenerated to request each of those pieces individually.

Or, maybe the above should be default behavior, period. Thoughts?
			-peace

--
Let he who is without clue kiss my ass.