460415 - Successfully log in with incorrect password

Status: RESOLVED DUPLICATE of bug 211006

(Bugzilla :: User Accounts, defect)

Description

[Tan Minh Huynh]

User-Agent:       Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.9.0.2) Gecko/2008090514 Firefox/3.0.2 (.NET CLR 3.5.30729)
Build Identifier: Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.9.0.2) Gecko/2008090514 Firefox/3.0.2 (.NET CLR 3.5.30729)

You can successfully log in with incorrect password as long as your entered password that had prefix that was your correct password. Ex: your correct password is "Global Cybersoft", you can enter "Global Cybersoft VN" => you successfully log in. 

Reproducible: Always

Steps to Reproduce:
1.Enter your correct user name
2.Enter your incorrect password that had prefix was your correct password
3.You successfully log in
Actual Results:  
Successfully log in

Expected Results:  
Invalid user name and password

N/A

Comment 1

[bigstijn]

Tan,

1) are you talking about bugzilla.mozilla.org ?
2) If not, are you talking about the bugzilla product, which version ?

Comment 2

[Tan Minh Huynh]

Yes, I am talking about the bugzilla product version 3.0.5

Comment 3

[Frédéric Buclin]

That's because passwords are encrypted using crypt(), which only takes the first 8 characters into account. To take more than 8 characters, we need to move to MD5, which is the topic of bug 211006.