TYPO3 Core

Patch set 1 for branch master of project Packages/TYPO3.CMS has been pushed to the review server.
It is available at https://review.typo3.org/46894

Here is a very little Extension that adds authentication service to test this.

With the patch applied it will just login any entered felogin-data with fe_user of uid 1.
Without the patch login will only be successful if the entered data is correct as only the regular SaltedPasswordService logic comes into play.

The saltedpassword service has to be the last one for security reasons if the user uses a salted password. This issue can't be solved by changing that chain.

We can lower the priority of the saltedpassword service to make it easier the overrule it. This is for master only and needs a breaking.rst file.

Hi Robert,

can you recheck the issue with TYPO3 v9, we've improved the situation and tried to reduce complexity now by migrated SaltedPasswordService into the general AuthenticationService.

Thanks.
Benni.

No feedback since the last 90 days => closing this issue.

If you think that this is the wrong decision or experience the issue again and have more information about how to reproduce your problem, please reopen it or open a new issue with a reference to this one.

Thank you and best regards