CVE-2020-5248 (published 2020-05-12T16:15Z)

GLPI before before version 9.4.6 has a vulnerability involving a default encryption key. GLPIKEY is public and is used on every instance. This means anyone can decrypt sensitive data stored using this key. It is possible to change the key before installing GLPI. But on existing instances, data must be reencrypted with the new key. Problem is we can not know which columns or rows in the database are using that; espcially from plugins. Changing the key without updating data would lend in bad password sent from glpi; but storing them again from the UI will work.

Severity: MEDIUM
CVSS v2 base score: 5.0 (AV:N/AC:L/Au:N/C:P/I:N/A:N)
CVSS v3 base score: 5.3, MEDIUM (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N)

Weakness information:
cwe_id: CWE-798
cwe_name: Use of Hard-coded Credentials
description: The product contains hard-coded credentials, such as a password or cryptographic key.
extended_description: 
		   There are two main variations:
		   
			 Inbound: the product contains an authentication mechanism that checks the input credentials against a hard-coded set of credentials. In this variant, a default administration account is created, and a simple password is hard-coded into the product and associated with that account. This hard-coded password is the same for each installation of the product, and it usually cannot be changed or disabled by system administrators without manually modifying the program, or otherwise patching the product. It can also be difficult for the administrator to detect.
			 Outbound: the product connects to another system or component, and it contains hard-coded credentials for connecting to that component. This variant applies to front-end systems that authenticate with a back-end service. The back-end service may require a fixed password that can be easily discovered. The programmer may simply hard-code those back-end credentials into the front-end product.
		   
         
         

Fix information:
repo_url: https://github.com/glpi-project/glpi
commit_details: repo_url: https://github.com/glpi-project/glpi
author: Johan Cwiklinski
author_date: 2020-02-06 10:16:01+01:00
msg: Deprecate GLPIKEY usage

CVE-2020-5248

Deprecate GLPIKEY usage, and replace it with key file per instance.
Add a command to generate new key, and update database.
Add plugins hooks to register fields or configuration entries to be
handled when updating db.
repository: repo_url: https://github.com/glpi-project/glpi
repo_name: glpi-project/glpi
description: GLPI is a Free Asset and IT Management Software package, Data center management, ITIL Service Desk, licenses tracking and software auditing.
repo_language: PHP
owner: glpi-project
file_changes: filename: .gitignore
change_type: ModificationType.MODIFY
diff: @@ -1,4 +1,5 @@
 /config/config_db*
+/config/glpi.key
 /config/config_path.php
 /config/local_define.php
 /tests/config_db*

programming_language: PHP
filename: mailcollector.php
change_type: ModificationType.MODIFY
diff: @@ -58,7 +58,7 @@ if (isset($_REQUEST['action'])) {
             if (empty($input["passwd"])) {
                unset($input["passwd"]);
             } else {
-               $input["passwd"] = Toolbox::encrypt(stripslashes($input["passwd"]), GLPIKEY);
+               $input["passwd"] = Toolbox::encrypt(stripslashes($input["passwd"]));
             }
          }
 

programming_language: PHP
filename: auth.class.php
change_type: ModificationType.MODIFY
diff: @@ -664,8 +664,7 @@ class Auth extends CommonGLPI {
                   $ds = AuthLdap::connectToServer($ldap_method["host"],
                                                   $ldap_method["port"],
                                                   $ldap_method["rootdn"],
-                                                  Toolbox::decrypt($ldap_method["rootdn_passwd"],
-                                                                   GLPIKEY),
+                                                  Toolbox::decrypt($ldap_method["rootdn_passwd"]),
                                                   $ldap_method["use_tls"],
                                                   $ldap_method["deref_option"]);
 

programming_language: PHP
filename: authldap.class.php
change_type: ModificationType.MODIFY
diff: @@ -192,8 +192,7 @@ class AuthLDAP extends CommonDBTM {
          if (empty($input["rootdn_passwd"])) {
             unset($input["rootdn_passwd"]);
          } else {
-            $input["rootdn_passwd"] = Toolbox::encrypt(stripslashes($input["rootdn_passwd"]),
-                                                       GLPIKEY);
+            $input["rootdn_passwd"] = Toolbox::encrypt(stripslashes($input["rootdn_passwd"]));
          }
       }
 
@@ -1456,7 +1455,7 @@ class AuthLDAP extends CommonDBTM {
          $port = $config_ldap->fields['port'];
       }
       $ds = self::connectToServer($host, $port, $config_ldap->fields['rootdn'],
-                                  Toolbox::decrypt($config_ldap->fields['rootdn_passwd'], GLPIKEY),
+                                  Toolbox::decrypt($config_ldap->fields['rootdn_passwd']),
                                   $config_ldap->fields['use_tls'],
                                   $config_ldap->fields['deref_option']);
       if ($ds) {
@@ -2608,7 +2607,7 @@ class AuthLDAP extends CommonDBTM {
 
       return $this->connectToServer($this->fields['host'], $this->fields['port'],
                                     $this->fields['rootdn'],
-                                    Toolbox::decrypt($this->fields['rootdn_passwd'], GLPIKEY),
+                                    Toolbox::decrypt($this->fields['rootdn_passwd']),
                                     $this->fields['use_tls'],
                                     $this->fields['deref_option']);
    }
@@ -2669,7 +2668,7 @@ class AuthLDAP extends CommonDBTM {
       }
       $ds = self::connectToServer($ldap_method['host'], $ldap_method['port'],
                                   $ldap_method['rootdn'],
-                                  Toolbox::decrypt($ldap_method['rootdn_passwd'], GLPIKEY),
+                                  Toolbox::decrypt($ldap_method['rootdn_passwd']),
                                   $ldap_method['use_tls'], $ldap_method['deref_option']);
 
       // Test with login and password of the user if exists
@@ -2686,7 +2685,7 @@ class AuthLDAP extends CommonDBTM {
          foreach (self::getAllReplicateForAMaster($ldap_method['id']) as $replicate) {
             $ds = self::connectToServer($replicate["host"], $replicate["port"],
                                         $ldap_method['rootdn'],
-                                        Toolbox::decrypt($ldap_method['rootdn_passwd'], GLPIKEY),
+                                        Toolbox::decrypt($ldap_method['rootdn_passwd']),
                                         $ldap_method['use_tls'], $ldap_method['deref_option']);
 
             // Test with login and password of the user
@@ -3442,7 +3441,7 @@ class AuthLDAP extends CommonDBTM {
 
       if (self::connectToServer($authldap->getField('host'), $authldap->getField('port'),
                                 $authldap->getField('rootdn'),
-                                Toolbox::decrypt($authldap->getField('rootdn_passwd'), GLPIKEY),
+                                Toolbox::decrypt($authldap->getField('rootdn_passwd')),
                                 $authldap->getField('use_tls'),
                                 $authldap->getField('deref_option'))) {
          self::showLdapUsers();
@@ -3500,7 +3499,7 @@ class AuthLDAP extends CommonDBTM {
       }
 
       if (isset($input["rootdn_passwd"]) && !empty($input["rootdn_passwd"])) {
-         $input["rootdn_passwd"] = Toolbox::encrypt(stripslashes($input["rootdn_passwd"]), GLPIKEY);
+         $input["rootdn_passwd"] = Toolbox::encrypt(stripslashes($input["rootdn_passwd"]));
       }
 
       return $input;

programming_language: PHP
filename: config.class.php
change_type: ModificationType.MODIFY
diff: @@ -151,7 +151,7 @@ class Config extends CommonDBTM {
          if (empty($input["smtp_passwd"])) {
             unset($input["smtp_passwd"]);
          } else {
-            $input["smtp_passwd"] = Toolbox::encrypt(stripslashes($input["smtp_passwd"]), GLPIKEY);
+            $input["smtp_passwd"] = Toolbox::encrypt(stripslashes($input["smtp_passwd"]));
          }
       }
 
@@ -163,8 +163,7 @@ class Config extends CommonDBTM {
          if (empty($input["proxy_passwd"])) {
             unset($input["proxy_passwd"]);
          } else {
-            $input["proxy_passwd"] = Toolbox::encrypt(stripslashes($input["proxy_passwd"]),
-                                                      GLPIKEY);
+            $input["proxy_passwd"] = Toolbox::encrypt(stripslashes($input["proxy_passwd"]));
          }
       }
 

programming_language: PHP
filename: changekeycommand.class.php
change_type: ModificationType.ADD
diff: @@ -0,0 +1,110 @@
+<?php
+/**
+ * ---------------------------------------------------------------------
+ * GLPI - Gestionnaire Libre de Parc Informatique
+ * Copyright (C) 2015-2018 Teclib' and contributors.
+ *
+ * http://glpi-project.org
+ *
+ * based on GLPI - Gestionnaire Libre de Parc Informatique
+ * Copyright (C) 2003-2014 by the INDEPNET Development Team.
+ *
+ * ---------------------------------------------------------------------
+ *
+ * LICENSE
+ *
+ * This file is part of GLPI.
+ *
+ * GLPI is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License as published by
+ * the Free Software Foundation; either version 2 of the License, or
+ * (at your option) any later version.
+ *
+ * GLPI is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with GLPI. If not, see <http://www.gnu.org/licenses/>.
+ * ---------------------------------------------------------------------
+ */
+
+namespace Glpi\Console\Security;
+
+if (!defined('GLPI_ROOT')) {
+   die("Sorry. You can't access this file directly");
+}
+
+use Glpi\Console\AbstractCommand;
+use Symfony\Component\Console\Input\InputInterface;
+use Symfony\Component\Console\Output\OutputInterface;
+use Symfony\Component\Console\Question\ConfirmationQuestion;
+use GLPIKey;
+
+class ChangekeyCommand extends AbstractCommand {
+   /**
+    * Error code returned when unable to renew key.
+    *
+    * @var integer
+    */
+   const ERROR_UNABLE_TO_RENEW_KEY = 1;
+
+   protected function configure() {
+      parent::configure();
+
+      $this->setName('glpi:security:change_key');
+      $this->setDescription(__('Change password storage key and update values in database.'));
+   }
+
+   protected function execute(InputInterface $input, OutputInterface $output) {
+      $glpikey = new GLPIKey();
+
+      $fields = $glpikey->getFields();
+      $configs = $glpikey->getConfigs();
+      $conf_count = 0;
+      foreach ($configs as $config) {
+         $conf_count += count($config);
+      }
+
+      $output->writeln(
+         sprintf(
+            '<info>' . __('Found %1$s field(s) and %2$s configuration entries requiring migration.') . '</info>',
+            count($fields),
+            $conf_count
+         )
+      );
+
+      if (!$input->getOption('no-interaction')) {
+         // Ask for confirmation (unless --no-interaction)
+         $question_helper = $this->getHelper('question');
+         $run = $question_helper->ask(
+            $input,
+            $output,
+            new ConfirmationQuestion(__('Do you want to continue ?') . ' [Yes/no]', true)
+         );
+         if (!$run) {
+            $output->writeln(
+               '<comment>' . __('Aborted.') . '</comment>',
+               OutputInterface::VERBOSITY_VERBOSE
+            );
+            return 0;
+         }
+      }
+
+      $created = $glpikey->generate();
+      if (!$created) {
+         $output->writeln(
+            '<error>' . __('Unable to change security key!') . '</error>',
+            OutputInterface::VERBOSITY_QUIET
+         );
+         return self::ERROR_UNABLE_TO_RENEW_KEY;
+      }
+
+      $this->output->write(PHP_EOL);
+
+      $output->writeln('<info>' . __('New security key generated; database updated.') . '</info>');
+
+      return 0; // Success
+   }
+}

programming_language: PHP
filename: glpikey.class.php
change_type: ModificationType.ADD
diff: @@ -0,0 +1,225 @@
+<?php
+/**
+ * ---------------------------------------------------------------------
+ * GLPI - Gestionnaire Libre de Parc Informatique
+ * Copyright (C) 2015-2018 Teclib' and contributors.
+ *
+ * http://glpi-project.org
+ *
+ * based on GLPI - Gestionnaire Libre de Parc Informatique
+ * Copyright (C) 2003-2014 by the INDEPNET Development Team.
+ *
+ * ---------------------------------------------------------------------
+ *
+ * LICENSE
+ *
+ * This file is part of GLPI.
+ *
+ * GLPI is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License as published by
+ * the Free Software Foundation; either version 2 of the License, or
+ * (at your option) any later version.
+ *
+ * GLPI is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with GLPI. If not, see <http://www.gnu.org/licenses/>.
+ * ---------------------------------------------------------------------
+ */
+
+if (!defined('GLPI_ROOT')) {
+   die("Sorry. You can't access this file directly");
+}
+
+/**
+ *  GLPI security key
+**/
+class GLPIKey {
+   /**
+    * Key file path.
+    *
+    * @var string
+    */
+   private $keyfile;
+
+   /**
+    * List of crypted DB fields.
+    *
+    * @var array
+    */
+   protected $fields = [
+      'glpi_mailcollectors.passwd',
+      'glpi_authldaps.rootdn_passwd'
+   ];
+
+   /**
+    * List of crypted configuration values.
+    * Each key corresponds to a configuration context, and contains list of configs names.
+    *
+    * @var array
+    */
+   protected $configs = [
+      'core'   => [
+         'smtp_passwd',
+         'proxy_passwd'
+      ]
+   ];
+
+   public function __construct() {
+      $this->keyfile = GLPI_CONFIG_DIR . '/glpi.key';
+   }
+
+   /**
+    * Check if GLPI security key used for decryptable passwords exists
+    *
+    * @return string
+    */
+   public function keyExists() {
+      return file_exists($this->keyfile) && !empty($this->get());
+   }
+
+   /**
+    * Get GLPI security key used for decryptable passwords
+    *
+    * @return string
+    */
+   public function get() {
+      $key = GLPIKEY;
+      if (file_exists($this->keyfile)) {
+         //load key from existing config file
+         $key = file_get_contents($this->keyfile);
+      }
+      return $key;
+   }
+
+   /**
+    * Generate GLPI security key used for decryptable passwords
+    * and update values in DB if necessary.
+    *
+    * @return boolean
+    */
+   public function generate() {
+      global $DB;
+
+      $current_key = file_exists($this->keyfile) ? $this->get() : GLPIKEY;
+
+      $success = (bool)file_put_contents($this->keyfile, Toolbox::getRandomString(50));
+      if (!$success) {
+         return false;
+      }
+
+      if ($DB instanceof DBmysql) {
+         return $this->migrateFieldsInDb($current_key)
+            && $this->migrateConfigsInDb($current_key);
+      }
+
+      return true;
+   }
+
+   /**
+    * Get fields
+    *
+    * @return array
+    */
+   public function getFields() {
+      global $PLUGIN_HOOKS;
+
+      $fields = $this->fields;
+      if (isset($PLUGIN_HOOKS['secured_fields'])) {
+         foreach ($PLUGIN_HOOKS['secured_fields'] as $plugfields) {
+            $fields = array_merge($fields, $plugfields);
+         }
+      }
+
+      return $fields;
+   }
+
+   /**
+    * Get configs
+    *
+    * @return array
+    */
+   public function getConfigs() {
+      global $PLUGIN_HOOKS;
+
+      $configs = $this->configs;
+
+      if (isset($PLUGIN_HOOKS['secured_configs'])) {
+         foreach ($PLUGIN_HOOKS['secured_configs'] as $plugin => $plugconfigs) {
+            $configs['plugin:' . $plugin] = $plugconfigs;
+         }
+      }
+
+      return $configs;
+   }
+
+   /**
+    * Migrate fields in database
+    *
+    * @param string $current_key Current key
+    *
+    * @return void
+    */
+   protected function migrateFieldsInDb($current_key) {
+      global $DB;
+
+      $success = true;
+
+      foreach ($this->getFields() as $field) {
+         list($table, $column) = explode('.', $field);
+
+         $iterator = $DB->request([
+            'SELECT' => ['id', $column],
+            'FROM'   => $table
+         ]);
+
+         while ($success && $row = $iterator->next()) {
+            $pass = Toolbox::encrypt(Toolbox::decrypt($row[$column], $current_key));
+            $success = $DB->update(
+               $table,
+               [$field  => $pass],
+               ['id'    => $row['id']]
+            );
+         }
+      }
+
+      return $success;
+   }
+
+   /**
+    * Migrate configurations in database
+    *
+    * @param string $current_key Current key
+    *
+    * @return boolean
+    */
+   protected function migrateConfigsInDb($current_key) {
+      global $DB;
+
+      $success = true;
+
+      foreach ($this->getConfigs() as $context => $names) {
+         $iterator = $DB->request([
+            'FROM'   => Config::getTable(),
+            'WHERE'  => [
+               'context'   => $context,
+               'name'      => $names
+            ]
+         ]);
+
+         while ($success && $row = $iterator->next()) {
+            $pass = Toolbox::encrypt(Toolbox::decrypt($row['value'], $current_key));
+            $success = $DB->update(
+               Config::getTable(),
+               ['value' => $pass],
+               ['id'    => $row['id']]
+            );
+         }
+      }
+
+      return $success;
+   }
+}

programming_language: PHP
filename: glpimailer.class.php
change_type: ModificationType.MODIFY
diff: @@ -65,7 +65,7 @@ class GLPIMailer extends PHPMailer {
          if ($CFG_GLPI['smtp_username'] != '') {
             $this->SMTPAuth = true;
             $this->Username = $CFG_GLPI['smtp_username'];
-            $this->Password = Toolbox::decrypt($CFG_GLPI['smtp_passwd'], GLPIKEY);
+            $this->Password = Toolbox::decrypt($CFG_GLPI['smtp_passwd']);
          }
 
          if ($CFG_GLPI['smtp_mode'] == MAIL_SMTPSSL) {

programming_language: PHP
filename: mailcollector.class.php
change_type: ModificationType.MODIFY
diff: @@ -145,7 +145,7 @@ class MailCollector  extends CommonDBTM {
          if (empty($input["passwd"])) {
             unset($input["passwd"]);
          } else {
-            $input["passwd"] = Toolbox::encrypt(stripslashes($input["passwd"]), GLPIKEY);
+            $input["passwd"] = Toolbox::encrypt(stripslashes($input["passwd"]));
          }
       }
 
@@ -174,7 +174,7 @@ class MailCollector  extends CommonDBTM {
          if (empty($input["passwd"])) {
             unset($input["passwd"]);
          } else {
-            $input["passwd"] = Toolbox::encrypt(stripslashes($input["passwd"]), GLPIKEY);
+            $input["passwd"] = Toolbox::encrypt(stripslashes($input["passwd"]));
          }
       }
 
@@ -1218,14 +1218,14 @@ class MailCollector  extends CommonDBTM {
 
       if ($this->fields['use_kerberos']) {
          $this->marubox = @imap_open($this->fields['host'], $this->fields['login'],
-                                     Toolbox::decrypt($this->fields['passwd'], GLPIKEY),
+                                     Toolbox::decrypt($this->fields['passwd']),
                                      CL_EXPUNGE, 1);
       } else {
          $try_options = [['DISABLE_AUTHENTICATOR' => 'GSSAPI'],
                               ['DISABLE_AUTHENTICATOR' => 'PLAIN']];
          foreach ($try_options as $option) {
             $this->marubox = @imap_open($this->fields['host'], $this->fields['login'],
-                                        Toolbox::decrypt($this->fields['passwd'], GLPIKEY),
+                                        Toolbox::decrypt($this->fields['passwd']),
                                         CL_EXPUNGE, 1, $option);
             if (is_resource($this->marubox)) {
                break;

programming_language: PHP
filename: rssfeed.class.php
change_type: ModificationType.MODIFY
diff: @@ -880,8 +880,7 @@ class RSSFeed extends CommonDBVisible {
          if (!empty($CFG_GLPI["proxy_user"])) {
             $prx_opt[CURLOPT_HTTPAUTH]     = CURLAUTH_ANYSAFE;
             $prx_opt[CURLOPT_PROXYUSERPWD] = $CFG_GLPI["proxy_user"].":".
-                                             Toolbox::decrypt($CFG_GLPI["proxy_passwd"],
-                                                              GLPIKEY);
+                                             Toolbox::decrypt($CFG_GLPI["proxy_passwd"]);
          }
          $feed->set_curl_options($prx_opt);
       }

programming_language: PHP
filename: toolbox.class.php
change_type: ModificationType.MODIFY
diff: @@ -239,7 +239,15 @@ class Toolbox {
     *
     * @return encrypted string
    **/
-   static function encrypt($string, $key) {
+   static function encrypt($string, $key = null) {
+
+      if ($key === null) {
+         $key = self::getGlpiSecKey();
+      }
+
+      if ($key === GLPIKEY && !defined('TU_USER')) {
+         self::deprecated('Using GLPIKEY is not secure!');
+      }
 
       $result = '';
       for ($i=0; $i<strlen($string); $i++) {
@@ -260,7 +268,11 @@ class Toolbox {
     *
     * @return decrypted string
    **/
-   static function decrypt($string, $key) {
+   static function decrypt($string, $key = null) {
+
+      if ($key === null) {
+         $key = self::getGlpiSecKey();
+      }
 
       $result = '';
       $string = base64_decode($string);
@@ -275,6 +287,19 @@ class Toolbox {
       return Toolbox::unclean_cross_side_scripting_deep($result);
    }
 
+   /**
+    * Get GLPI security key used for decryptable passwords
+    *
+    * Will read key from config/glpi.key if present.
+    * For 9.4 branch, this will defaults to GLPIKEY.
+    *
+    * @return string
+    */
+   public static function getGlpiSecKey() {
+      $glpikey = new GLPIKey();
+      return $glpikey->get();
+   }
+
 
    /**
     * Prevent from XSS
@@ -1737,7 +1762,7 @@ class Toolbox {
          if (!empty($CFG_GLPI["proxy_user"])) {
             $opts += [
                CURLOPT_PROXYAUTH    => CURLAUTH_BASIC,
-               CURLOPT_PROXYUSERPWD => $CFG_GLPI["proxy_user"] . ":" . self::decrypt($CFG_GLPI["proxy_passwd"], GLPIKEY),
+               CURLOPT_PROXYUSERPWD => $CFG_GLPI["proxy_user"] . ":" . self::decrypt($CFG_GLPI["proxy_passwd"]),
             ];
          }
 

programming_language: PHP
filename: update.class.php
change_type: ModificationType.MODIFY
diff: @@ -163,7 +163,8 @@ class Update extends CommonGLPI {
       $updir = __DIR__ . "/../install/";
 
       if (isCommandLine() && version_compare($current_version, '0.72.3', 'lt')) {
-         die('Upgrade from command line is not supported before 0.72.3!');
+         echo 'Upgrade from command line is not supported before 0.72.3!';
+         die(1);
       }
 
       // Update process desactivate all plugins
@@ -500,6 +501,12 @@ class Update extends CommonGLPI {
       $crontask_telemetry->getFromDBbyName("Telemetry", "telemetry");
       $crontask_telemetry->resetDate();
       $crontask_telemetry->resetState();
+
+      //generate security key if missing, and update db
+      $glpikey = new GLPIKey();
+      if (!$glpikey->keyExists() && !$glpikey->generate()) {
+         $this->migration->displayWarning(__('Unable to create security key file!'), true);
+      }
    }
 
    /**

programming_language: PHP
filename: install.php
change_type: ModificationType.MODIFY
diff: @@ -375,6 +375,18 @@ function step4 ($databasename, $newdatabasename) {
       Html::closeForm();
    }
 
+   //create security key
+   $glpikey = new GLPIKey();
+   $secured = $glpikey->keyExists();
+   if (!$secured) {
+      $secured = $glpikey->generate();
+   }
+   if (!$secured) {
+      echo "<p><strong>".__('Security key cannot be generated!')."</strong></p>";
+      prev_form($host, $user, $password);
+      return;
+   }
+
    //Check if the port is in url
    $hostport = explode(":", $host);
    if (count($hostport) < 2) {

programming_language: PHP
filename: status.php
change_type: ModificationType.MODIFY
diff: @@ -104,8 +104,7 @@ if (($ok_master || $ok_slave )
       foreach ($ldap_methods as $method) {
          echo " ".$method['name'];
          if (AuthLDAP::tryToConnectToServer($method, $method["rootdn"],
-                                            Toolbox::decrypt($method["rootdn_passwd"],
-                                            GLPIKEY))) {
+                                            Toolbox::decrypt($method["rootdn_passwd"]))) {
             echo "_OK";
          } else {
             echo "_PROBLEM";

programming_language: PHP
filename: AuthLdap.php
change_type: ModificationType.MODIFY
diff: @@ -159,16 +159,16 @@ class AuthLDAP extends DbTestCase {
       $input    = ['name' => 'ldap', 'rootdn_passwd' => $password];
       $result   = $ldap->prepareInputForUpdate($input);
 
-      //Expected value to be encrypted using GLPIKEY key
-      $expected = \Toolbox::encrypt(stripslashes($password), GLPIKEY);
+      //Expected value to be encrypted using current  key
+      $expected = \Toolbox::encrypt(stripslashes($password));
       $this->string($result['rootdn_passwd'])->isIdenticalTo($expected);
 
       $password = 'tot\'o';
       $input    = ['name' => 'ldap', 'rootdn_passwd' => $password];
       $result   = $ldap->prepareInputForUpdate($input);
 
-      //Expected value to be encrypted using GLPIKEY key
-      $expected = \Toolbox::encrypt(stripslashes($password), GLPIKEY);
+      //Expected value to be encrypted using current key
+      $expected = \Toolbox::encrypt(stripslashes($password));
       $this->string($result['rootdn_passwd'])->isIdenticalTo($expected);
 
       $input['_blank_passwd'] = 1;

programming_language: PHP