Add the ability to locally cache passwords validated by external means

This can, for instance, be used to allow LDAP authenticated users to use the
API without manually setting a password, as long as they've logged in using
the web interface at least once.

1 files changed, 5 insertions, 0 deletions

diff --git a/login.php b/login.php
index 91e379cf..e7611611 100644
--- a/login.php
+++ b/login.php
@@ -130,6 +130,11 @@ if (($_POST['username'] && $_POST['password']) ||
 			}
 		} // End if auto_create
 
+		// This allows stealing passwords validated by external means
+		// such as LDAP
+		if (Config::get('auth_password_save') && $auth['success'] && $password) {
+			$user->update_password($password);
+		}
 	} // if we aren't in demo mode
 
 } // if they passed a username/password