Comments on: imap authentication plugin

By: Nurm

Nurm — Sun, 04 Dec 2005 21:17:59 +0000

I have updated the plugin to deal with this security issue.

By: Nurm

Nurm — Mon, 22 Aug 2005 13:49:20 +0000

Indeed. It could be ’secured’ a bit more by adding a secret keyword in login and check_password functions that is only known to the server admin. Unfortuantly this ‘fix’ is still open to offline brute force attacks.

By: Mark Quinn

Mark Quinn — Mon, 22 Aug 2005 04:05:51 +0000

I like the plugin, but I think it has some serious security issues (that come from the http-authentication plugin). Because the check passwords function simply sets both passwords to the username, the security can be bypassed with some trivially forged cookies. The value set as the password needs to be something that the user doesn’t already know.

By: James Cole

James Cole — Sun, 21 Aug 2005 02:18:37 +0000

Thanks for the reply, that was it, I had a space after the ‘?>’ on the last line. I had no idea PHP was so picky, I’m a perl guy myself. Anyway, great plugin, thanks a lot.

By: Nurm

Nurm — Sat, 20 Aug 2005 20:05:12 +0000

You probably find that the file has a blank line at the bottom, make sure that the closing ‘?>’ is the final two bytes in the file, and that there isn’t a newline afterwards.

By: James Cole

James Cole — Fri, 19 Aug 2005 21:47:26 +0000

I’m trying to set this up with WordPress 1.5.2, fresh install, nothing out of the ordinary and as soon as I enable the plugin, I get lines like this everywhere:

Warning: Cannot modify header information – headers already sent by (output started at /usr/local/var/www/internal/news/wp-content/plugins/imap-authentication.php:153) in /usr/local/var/www/internal/news/wp-admin/admin.php on line 10

Any Idea? I have the same problem with the http authentication module.

By: Nurm

Nurm — Fri, 03 Jun 2005 09:17:15 +0000

If you’ve got a tool like netcat, or tcpdump, try and see what data is being sent to the mail server. I’m guessing that it’s probably trying to enable TLS and the server doesn’t support it.

By: James

James — Thu, 02 Jun 2005 21:00:23 +0000

It keeps saying I have an incorrect password.

I can telnet like this just fine:
telnet your.imap.host.com 143
* OK [CAPABILITY IMAP4REV1...]
1 LOGIN “your_username” “your_password”
1 OK [CAPABILITY...] … User your_username authenticated

I have {my.imap.host.com:143}INBOX as my mailbox and no user suffix, yet it doesn’t work.

Any ideas?

By: Mo-ing » 2 Authentication plugins

Mo-ing » 2 Authentication plugins — Mon, 25 Apr 2005 02:16:25 +0000

[...] Through Photo Matt, here are two auth plugins which are interesting: * HTTP auth * IMAP auth

By: Matt

Matt — Sat, 23 Apr 2005 16:42:09 +0000

FYI for readers, it’s in the Plugin Repository here:

http://svn.wp-plugins.org/imap-authentication/trunk/