Description Sönke Schwardt-Krummrich 2016-08-16 15:56:30 CEST

The following code snippet from 
ucs-school-4.1r2/ucs-school-lib/python/models/utils.py contains several problems:

1) thrown exceptions are not correctly caught (→ "except Exception:")
2) if policy_result() returns without exception but univentionPWLength is not
   set, then
   _pw_length_cache[dn] = int(results.get('univentionPWLength', ['8'])[0])
   returns always hardcoded 8 as password length. Even if the argument of
   create_passwd() defined something else.
3) if a pw policy is defined for the user AND for the OU, the pw policy 
   for the OU wins:
   length = _pw_length_cache.get(ou, length)
   This should not be the case, because policy_result() already extracts the
   correct value for the user.
4) the determination of the OU's DN fails if the UCS@school user is not 
   positioned below an OU. This might be a problem since UCS@school 4.1R2.
5) if the callee requested a longer password (length=20), length may be
   overwritten by a smaller value if a pw policy is set.

def create_passwd(length=8, dn=None, specials='@#$%&*-_+=\:,.;?/()'):
  if dn:
    # get dn pw policy
    if not _pw_length_cache.get(dn):
      try:
        results, policies = policy_result(dn)
        _pw_length_cache[dn] = int(results.get('univentionPWLength', ['8'])[0])
      except Exception:
        pass
    length = _pw_length_cache.get(dn, length)

    # get ou pw policy
    ou = 'ou=' + dn[dn.find('ou=') + 3:]
    if not _pw_length_cache.get(ou):
      try:
        results, policies = policy_result(ou)
        _pw_length_cache[ou] = int(results.get('univentionPWLength', ['8'])[0])
      except Exception:
        pass
    length = _pw_length_cache.get(ou, length)