readable values within sessions

[tanita]

Hi,

I have an rearly important question about my sessions. I build an object, which is saved in a session by successful login. About this object its possible to grap to all attributes, wich are needed to change attributes in ldap. Problem is, within the session the password ist printed in plain text...

Is it possible to to manipulate the value before it is put in the session, or that it exsists, but not printed? Has anyone an idea how to solve this problem?

Thanks,

Tanja

[amcgrath]

Have you tried md5()?

[[deleted]]

Not good, because the md5 password is not the original password, and the ldap server won't let you logon.

[amcgrath]

Ah. I really haven't done much with ldap (I don't know why, it just worked out that way).

[tanita]

Hi,

in our ldap-server is tuned for SHA1, but crypt is already accepted. But thats not the problem, therefore I use ldapfuctions. It just refers to the session-file in /tmp an it is possible to read it. Thus I build an object, wich contains all attributes I defined, they printed in that session all one after an other. If someone logs in, you just read the session and know its password! I think the simplest way is, taking out atrribut 'pwd' of the class.. But thats not what I rearly want to do...

Tanja